bugtraq - Myspace Friend Train v2.8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060518213414.11670.qmail@securityfocus.com>
Date: 18 May 2006 21:34:14 -0000
From: luny@...fucktard.com
To: bugtraq@...urityfocus.com
Subject: Myspace Friend Train v2.8

Myspace Friend Train v2.8

Full path disclosure & possible SQL injection.
<BR><BR>
Its possible to put ' in the input myspace ID box to get the error. Example of the
error is below:
<BR><BR>
<b>Invalid query: You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
'72.150.32.136')' at line 1 Whole query: INSERT INTO train ( count, id, display,
pictureurl, age, gender, quote, address) values( '6', '\'', '',
'http://i.myspace.com/site/images/no_pic.gif', '', '', '\', '72.150.32.136')
</b>
<BR><BR>
example that discloses a full path error is:

http://www.example.com/myspacetrain/show.php?show=join'