Re: dvddb-0.6 media sql-inj. vuln.

To: "gokhankaya@xxxxxxxxxxx" <gokhankaya@xxxxxxxxxxx>
Subject: Re: dvddb-0.6 media sql-inj. vuln.
From: str0ke <str0ke@xxxxxxxxxxx>
Date: Mon, 5 Feb 2007 11:10:15 -0600
Cc: bugtraq@xxxxxxxxxxxxxxxxx
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=Cl+GkhFvQ78lQ0xDlfFQJC2AykPnFrTZh8b7pLmuBwt8gdR9zmN30YbzqojpemwwoOLEKtZs2moMXUZ8rAH/qOcSb7x0V6HtCw7nJ1fDWVDZC7l1U9Gv8k2EJKk2/GHJsUojLZ86z7a8rrEXlaZ4gwsV3hi4MGR9TZFpRGIsvTA=
In-reply-to: <20070204224355.27923.qmail@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <20070204224355.27923.qmail@xxxxxxxxxxxxxxxxx>
Sender: milw0rm@xxxxxxxxx

On 4 Feb 2007 22:43:55 -0000, gokhankaya@xxxxxxxxxxx
<gokhankaya@xxxxxxxxxxx> wrote:

# ExpLoit       : http://[target]/[path]/inc/common.php?user=[sql]


inc/common.php only contains functions that are never called.

/str0ke