lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 10 Feb 2009 20:54:56 +0100
From: Francesco Bianchino <f.bianchino@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Craft Silicon Banking@...e SQL Injection

Craft Silicon Banking@...e SQL Injection

***********************************************************************

Author: Francesco Bianchino

Email: f.bianchino [at] gmail.com

Title: Craft Silicon Banking@...e SQL Injection

Product: Banking@...e - Net Banking

Versions Vulnerable: 2.1 and below

Vendor: Craft Silicon (www.craftsilicon.com)

***********************************************************************

Summary

Banking@...e is an home banking application that allows customers to access
their account information using the web.
The application uses data in a database management system that uses Structured
Query Language (SQL) as a data access standard.

**********************************************************************

Vulnerability Details

The login page of Net Banking is vulnerable to SQL Injection attack,
due to a missing input validation mechanisms.
An attacker can inject SQL code into the username and password fields,
altering the login procedure.
There is a classic error based injection, really easy to exploit to
take control
of the entire server.
Authentication bypass is possible using valid username, no password is
required,
or otherwise the user table can be arbitrary modified.

***********************************************************************

Exploit

http://www.example.com/document_root/Login.asp?LoginName='Some_SQL_Stuff&Password=&submit=Login

***********************************************************************

Solution

At the moment of writing this advisory there is no solution yet.
I advised Craft Silicon in November 2008 and i actually have received no answer.

***********************************************************************

Credits

Discovered by Francesco Bianchino.

Powered by blists - more mailing lists