Elite Gaming Ladders v3.0 SQL Injection Exploit

# Exploit Title: Elite Gaming Ladders v3.0 SQL Injection Exploit
# Date: January 3rd, 2010
# Author: Sora
# Version: 3.0
# Tested on: Windows and Linux

—————————————-
> Elite Gaming Ladders v3.0 SQL Injection Exploit
> Contact: vhr95zw [at] hotmail [dot] com
> Website: https://greyhathackers.wordpress.com/
> Google Dork: “Fuck all script kiddies.”

# Vulnerability Description:
Elite Gaming Ladders v3.0 suffers a remote SQL injection exploit (stats.php) in the “account” parameter.

# Solution:
Sanitize the database inputs or block the bad words. (UNION SELECT, UNION SELECT ALL, /*, –)

# Proof of Concept:
http://www.site.com/stats.php?account=627′

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: