lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 29 Dec 2006 23:03:02 -0000
From: DoZ@...kersCenter.com
To: bugtraq@...urityfocus.com
Subject: Spooky Login Multiple HTML Injection Vulnerability

This is a user management program where the users can register themselves by providing their username and passwords for protecting their webcontents. This program provide features like remembering login with cookies, automatic login, extended user info, expire user by date, admin can activate manually, registration page, tracks user logins, user can upload file, user can alter and add fields for user registration, users can login after expiry and more.


Advisory: Spooky Login Multiple HTML Injection Vulnerability


Hackers Center Security Group (http://www.hackerscenter.com)
Doz's Advisory


Risk: Medium to High
Vendor: www.spookylogin.com
Class: Input Validation Error


Vulnerable: 2.7

Exploit: Attackers can exploit these issues via a web client.


Remote: Yes
Local: Yes


XSS Hole:

/spooky/login/login.asp

/spooky/login/register.asp



SQL Hole"


/spooky/login/register.asp?UserUpdate=[sql]


/includes/a_register.asp

Powered by blists - more mailing lists