[Bug] SQL injection pada News Read ID (read.php?)

[poni]

Komponen yang terdapat bug sql injection = read.php
DORK: inurl:"read.php?id="

POC

Code: Select all

http://campus.sanook.com/inlove/read.php?id=132'
http://www.inspireyourworld.com/issue6/read.php?id=23'
http://www.wellerpools.com/news-read.php?id=16'

[poni]

http://www.wellerpools.com/news-read.php?id=16'


Dapat deh login Admin + Pass
Admin = chr1sty
Password : ************ cencored

[shad.hckr]

waw... razia neh ceritanya ya mas pon... hehehehe...
but keren juga tuh CMS...

[poni]

ada gr33tz untuk anda.. check it out

Code: Select all

http://www.wellerpools.com/testimonials.php

Btw. semua komponen bisa dimodifikasi. bahkan bisa upload shell.. tapi gue hanya sebatas edit testimonial.php saja. :P

[poni]

waw... razia neh ceritanya ya mas pon... hehehehe...
but keren juga tuh CMS...

iya.. lagi ga ada kerjaan, masih banyak web yang vuln dengan konten tersebut. cek aja dorknya

[demonbrando]

wah,abang poni mantep dah... tapi sayangnya passwordnya di sensor???

[shad.hckr]

wekekeke..

Code: Select all

poni : Miss christy, we don`t do any harm on the system. Just put this message . so you may fix your web soon. thanks

Gr33tz:

   ^Family-Code^, ^rumput_kering^, 0x99/JerryMaheswara, Paman, XShadow, psychopath, fl3xu5, gblack, mas_agung, Jundi, ^_xfree_^, systemofadown, yadoy666
, Phychole, Wilmar_Kidz, 3xtr3m3b0y, Darkzzzz, Shad.hckr,  And You... the marvellous XCoders those change the Indonesian Undergorund scenes

Http://forum.xcode.or.id

keren mas.. =))

Xcode gak kalah ma agnes monica yang Go International..

[anjay]

mantabz om poni

[shinichi81]

upload dong bos poni POC-nya...

[peniru]

wih.. nambah lagi nih bhan belajar....

tq kk poni.....