bugtraq - Softbiz Dating 1.0 SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060622172910.16358.qmail@securityfocus.com>
Date: 22 Jun 2006 17:29:10 -0000
From: securityconnection@...il.com
To: bugtraq@...urityfocus.com
Subject: Softbiz Dating 1.0 SQL injection


Softbiz Dating 1.0
http://www.softbizscripts.com
-----------------------------
-------------
SQL injection
-------------
http://target.xx/search_results.php?country=1[SQL]
http://target.xx/search_results.php?pg=2&sort_by=1[SQL]
http://target.xx/featured_photos.php?browse=1[SQL]
http://target.xx/products.php?cid=1[SQL]
http://target.xx/index.php?cid=1'[SQL]
http://target.xx/news_desc.php?id=1[SQL]
---
POST /products.php HTTP/1.1 
Host: target.xx 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 36 
PHPSESSID=1&keyword=1&Submit=1&cid=[SQL]
---
POST /search_results.php HTTP/1.1 
Host: target.xx 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 51 
PHPSESSID=1&keyword=1&show_save=1&Submit=1&browse=[SQL]
-----------------
Ellipsis Security
http://www.ellsec.org