| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20060830115330.27402.qmail@securityfocus.com> Date: 30 Aug 2006 11:53:30 -0000 From: farhadkey@...oo.com To: bugtraq@...urityfocus.com Subject: [KAPDA::#56] - FREEKOT SQL Injection Vulnerability KAPDA New advisory Vendor: http://www.digiappz.com Vulnerability: SQL_Injection Date : -------------------- Found : Aug 10, 2006 Vendor Contacted : N/A Release Date : Aug 30, 2006 About Freekot : -------------------- FREEKOT is a free tool which allows you to insert a random quotation system or a quote of the day in your website. Vulnerability: -------------------- SQL_Injection: Input passed to the "login" and "password" parameters when logging into the administration section isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. PoC: -------------------- http://www.kapda.ir/attach-1996-xpl_freekot.htm Solution: -------------------- No patch`s released yet by vendor. Original Advisory: -------------------- http://www.kapda.ir/advisory-410.html Credit : -------------------- FarhadKey of KAPDA farhadkey [at} kapda <d0t> ir Kapda - Security Science Researchers Insitute of Iran http://www.KAPDA.ir
Powered by blists - more mailing lists