jSchool Advanced – SQL Injection
----------------------------------------------------------------------- Exploit Title : jSchool Advanced (SQL Injection) Vulnerability Dork : inurl: "action=profil.main" Found : 15 Jan '11 Author : eXa.DisC Software : jSchool Advanced (http://www.jogjacamp.com/script_4_Script_Website_Murah_Instant_Sekolah.html) Price : Rp. 1.200.000 Vendor : http://jogjacamp.com ----------------------------------------------------------------------- I. Demo Site ----------------------------------------------------------------------- http://site/index.php?action=profil.main&xid=1 II. POC ----------------------------------------------------------------------- http://site/index.php?action=profil.main&xid=[SQLi] III. Vendor patch ----------------------------------------------------------------------- Currently manufacturers do not provide patches or upgrades. IV. Credits ----------------------------------------------------------------------- - God - bawahtanah_sii : tenro, sality23, em32, tdos, kiwill and my-Org - XCODE - semua [komunitas IT dan netter] underground INDONESIA - All Friend's and Enemy who know me |