In my search for an XSS I stumbled upon somethin way more interesting!

So… what is this?

And the answer is:

DB’s (extracted by E***s – name will be published upon his request) :

test
investment_game
trafficflow

Database: trafficflow

User: root@localhost

Version: 4.1.23-5b-Yahoo-SMP-log

“users” table

Column login, uid

A2OSX[cenzored]UR6IL6:1:

A3CMY[cenzored]8ZS2:2:

A2TCIF[cenzored]BVB5:3:

4:

A84TYK[cenzored]FB:5:

OLDU[cenzored]ID1:6:

A3OIU[cenzored]92QU:7:

A3QMK[cenzored]02CGN:8:

A3MA5[cenzored]WA3SY:9:

A2WDR[cenzored]ZFN7:10:

A3UJ3[cenzored]9AX:11:

A300Q[cenzored]CNSFM:12:

ADAG[cenzored]WMEPT6:16:

A2S76[cenzored]7RM0IN:17:

ABX62[cenzored]ZDMIJ:18:

AW9UY[cenzored]VS0:19:

AQ44M[cenzored]ZJWYX:20:

A2SF4D[cenzored]PE5F8:21:

AWDPC[cenzored]PGKDP:22:

A3Q07H[cenzored]EFKDL:23:

A2BHX1[cenzored]FCI7:24:

ADTW4[cenzored]LUNL:25:

A2IN2[cenzored]ITCS:26:

A1HCF7[cenzored]GSGU:27:

A1B6XP[cenzored]6RS:28:

A2RV[cenzored]IAZS:29:

A1ORRI[cenzored]HIKZ:30:

A3VV1[cenzored]FCLY3:31:

AA37JM[cenzored]2MCSZ:32:

A3F0SW[cenzored]75GPF1:33:

A1APJ8[cenzored]D9DWG:34:

AYYF7[cenzored]03AV:35:

AC7N1[cenzored]P89E:36:

A4IGPY[cenzored]P7K:37:

A356EV[cenzored]U90R:38:

A33EA[cenzored]QEOM:39:

A37I63[cenzored]4EUGF:40:

A3KEBT[cenzored]KBG:41:

A3TVB8[cenzored]3L9PK:42:

A1BVJU[cenzored]VMVF:43:

A3ES8V[cenzored]X492:44:

A3SNB[cenzored]3HQ62:45:

A3UX2F[cenzored]JCS:46:

ASW2C[cenzored]VUJJ7:47:

AGOAU[cenzored]7FV3:48:

A62K7[cenzored]EBU4:49:

A3QPKI[cenzored]02MO:50:

A3U6F7[cenzored]IZXIO:51:

ASICV1[cenzored]HP6:52:

A1X5M[cenzored]EVPB:53:

AWRA[cenzored]YR0M:54:

A3A86[cenzored]D0U3O0:55:

A3DHO[cenzored]Q2FL69:56:

AWUAA[cenzored]W65Q:57:

A1GJRN[cenzored]WIAX:58:

A38UW[cenzored]JTQT:59:

A2CIBQ[cenzored]466Q:60:

A3Q9OR[cenzored]USM1D:61:

AKYD5Y[cenzored]2C4L:62:

AITEF[cenzored]CGHK2:63:

A1C3NL[cenzored]NUEE:64:

A1SXJB[cenzored]7PXG:65:

A1UV2NU[cenzored]D0F:66:

A2ALH[cenzored]68RWIC:67:

Vulnerable path will be published after the problem is solved by Yahoo!’s tech department. And of course more images.

Thank you Bobby for forwading this issue to Yahoo!.

Don’t forget to check this too: http://blog.rstcenter.com/2008/12/08/yahoocom-sql-injection-xss-se-intampla-si-la-case-mari/

Related Posts

• August 24, 2009 -- SQL Injection in Yahoo! kids website (patched)
• December 8, 2008 -- Yahoo.com SQL Injection, XSS [se intampla si la case mari]
• February 23, 2011 -- Concurs fara premii
• August 30, 2010 -- Deface (?!?) pe Cotidianul.ro
• April 21, 2010 -- France2.fr – France4.fr – in asteptarea atacului?