Myspace Friend Train v2.8 May 18 2006 09:34PM
luny youfucktard com
Myspace Friend Train v2.8

Full path disclosure & possible SQL injection.


Its possible to put ' in the input myspace ID box to get the error. Example of the

error is below:


<b>Invalid query: You have an error in your SQL syntax; check the manual that

corresponds to your MySQL server version for the right syntax to use near

'')' at line 1 Whole query: INSERT INTO train ( count, id, display,

pictureurl, age, gender, quote, address) values( '6', '\'', '',

'http://i.myspace.com/site/images/no_pic.gif', '', '', '\', '')



example that discloses a full path error is:


[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus