[FixAllthis]

Site is vulnerable to blind SQL interjection.

Database: cfpciowa

Username: cjadmin
Password: cjmaster
Username: eccadmin
Password:child497
Username:Anne
Password:child497
Username:Vivian
Password:eccadmin
Username:Sheila
Password:ecc123
Username:Alex
Password:ecc123
Username:slashx24
Password:killer12

They have a cpanel connected through to port 2082 that can be accessed through CSRF EXPLOIT that the OP can't access. So go ahead if you know how to accomplished the exploit fix the site from there then contact (515-280-9027) too help them further.

[pashabiceps]

lulwut

http://cfpciowa.org/page.php?id=10031

[xhflhkeuhwguu34]

This site has become a HF playground! This should be fun.

---

This site was developed by http://www.captainjack.com.

There could be other vulns in their sites.

[FixAllthis]

The site itself is full of blind sql vulns as I said above. With that exploit you're able to get full login details of everything you need. No need to dig further into it. The thing is why it hasn't been fully defaced by another user yet?

[๖ۣۜAlexander]

The site itself is full of blind sql vulns as I said above. With that exploit you're able to get full login details of everything you need. No need to dig further into it. The thing is why it hasn't been fully defaced by another user yet?

Because defacing a site that helps children is pure evil.

[FixAllthis]

There is also a XSS vuln within the contact.php. Seems no one has caught onto that one.

You can use Iframe if set input state in contact details set to 1 from defined definition such as example #" onmouseover=prompt(940621) // for script it can cause a javascript prompt to pop up.

example that you can transform for javascript:

address=3137%20Laguna%20Street&city=San%20Francisco&comments=1&email=sample%40email.tst&fax=317-317-3137&first_name=wrulssrp&last_name=wrulssrp&org=1&phone=555-666-0606&state=%22%20onmouseover%3dprompt%28901001%29%20bad%3d%22&submit=Send&userstring=wrulssrp&zip=94102

modify to defined definition for own use of XSS exploit.

Because defacing a site that helps children is pure evil.

I understand that. If you read my first post on this thread you will see I gave full details too access the site with admin rights and reclaim the site to give back to original owner.

[devilking55]

I just type http://cfpciowa.org/admin
and log in....

---

I change it to the hackforums.... It's now said hacked by hackforums...

[xhflhkeuhwguu34]

I just type http://cfpciowa.org/admin
and log in....

---

I change it to the hackforums.... It's now said hacked by hackforums...

Not allowed to do that, you're not supposed to link back here.

[devilking55]

Not allowed to do that, you're not supposed to link back here.

oops... Too late...
I didn't know that... I put someone name on the admin page... name blaze...

[xhflhkeuhwguu34]

BTW, why are there 2 login prompts? Only one works with the creds published.

[๖ۣۜAlexander]

Alright, somebody deleted all the adminaccounts. No fun for me..

[FixAllthis]

I am taking it over and giving it back to the original owners. This is enough. For the children.

[devilking55]

I made a admin account...
And the owner think you will hack it

[๖ۣۜAlexander]

The only Admin User there is at the moment is FixThisSite.

[devilking55]

Someone kill the site =(
It's all gone! no one survived!