|
|
|
|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 102
Members: 0
Total: 102
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
tricky sql injection [help needed] |
|
Posted: Mon Feb 09, 2009 2:51 pm |
|
|
x3roconf_ |
Advanced user |
|
|
Joined: May 01, 2008 |
Posts: 101 |
|
|
|
|
|
|
|
Code: | http://site.com/index.php?srh=&sh=&lg[tk]=1 |
No error.
Code: | http://site.com/index.php?srh=&sh=&lg[td]=1 |
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version...
SELECT .no_sr as surah_number, .no_vr as verse_number, .verse as td FROM WHERE (.verse like '%%' ) ORDER BY .no_sr, .no_vr
How i can exploit this? (or is it impossible?)
|
|
|
|
|
Posted: Tue Feb 10, 2009 12:59 am |
|
|
ingh1pped |
Advanced user |
|
|
Joined: Dec 13, 2008 |
Posts: 88 |
|
|
|
|
|
|
|
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|