full-disclosure - ANSA editorial system vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 9 Oct 2007 17:36:18 +0200
From: "Rosario Valotta" <rosario.valotta@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: ANSA editorial system vulnerable

ANSA is the greatest italian press agency. It has offices and employees all
around the world.
ANSA provides news to all main italian news aggregators and information web
sites.
ANSA is "trusted".
ANSA editorial web portal is vulnerable, it lacks the basic security
principles.
Everyone with a small knowledge of webapps security can sneak into ANSA
system and read/WRITE (fake) news.
As the system is "trusted" a very cunning and well written news will pass
the human supervision and be published online on ansa.it portal.
Details (in italian for the now) at rosario.valotta.googlepages.com

After notification, ANSA IT department has solved the issues.

Regards,
Rosario Valotta

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/