bugtraq - RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 14 Apr 2010 07:12:08 -0600
From: wsn1983@...il.com
To: bugtraq@...urityfocus.com
Subject: RJ-iTop Network Vulnerability Scanner System Multiple SQL
 Injection Vulnerabilities

RJ-iTop Network Vulnerability Scanner System Multiple SQL Injection Vulnerabilities

Vulnerable: v3.0.7.x 
Vendor:  www.rj-itop.com 
Category: Input Validation Error
Impact:   SQL injection

Details:
=========
Multiple SQL Injection Vulnerabilities has been found in DRJ-iTop Network Vulnerability Scanner System&#65292;
which can be exploited by malicious users to conduct SQL injection and script insertion attacks.
Authentication is required to exploit these vulnerabilities.

POC: 
=========
https://8.8.8.8/roleManager.jsp?type=query&id= [SQL Injection]

Timeline:
========
2009.10.19   Report to vendor (but vender did not respond)
2009.11.15   Report to vendor second times
2009.11.19   Report to CNNVD
2010.04.13   Public