PicoPublisher 2.0 – SQL Injection

• Exploit Database
• 123 阅读

• 作者： ZeTH
  日期： 2012-03-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18670/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

  # Exploit Title : PicoPublisher v2.0 Remote SQL injection # Date : 29/03/2012 # Author : ZeTH # Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com # Vendor : Pico Software # Site : http://pico.no/ # Version : 2.0 # Price : $29,00 # Dork : intext:"Drives med PicoPublisher" ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: --[1]-- Introduction PicoPublisher business software PicoPublisher is a product from Pico Software   [Manage your website]   PicoPublisher makes it easy to manage your website. With the built in templates you can add columns, slideshows, tabs, boxes and videos directly from the text editor.   [Manage your customers]   CRM systems are often too expensive for small businesses. With PicoPublisher you can manage your customers just as easy as your website. And at the same place!   [Create invoices]   Create professional PDF invoices in seconds. Add products to the database and insert products to the invoice directly. You will get notifications when invoices are overdue.     --[2]-- Vulnerability Files : [+] page.php [+] single.php   Attack Method : Remote SQL injection   POC : [+] http://site/page.php?id=SQLi [+] http://site/single.php?id=SQLi   Tables :   +-------------------+ | customers | expenses | gallery_category | gallery_photos | invoice_reminders | invoices | invoices_product | menu_items | menus | notes | options | orders | orders_product | pages | pico_comments | pico_config | pico_karma_voted | posts | product_list | users +-------------------+   --[3]-- Greetz hacktheplan8 [hellcome to new friends kasp3r, Pitung] MainHack Brotherhood, Kecoak Elektronik, Echo packetstormsecurity, exploit-db, 1337day Paman, Vrs-hCk, OoN_BoY, em|nem, [S]hiro, Martin, xshadow, ElDiablo, Furkan, pizzyroot, H312Y