bugtraq - DDIVRT-2009-26 LogRover SQL Injection Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 13 Jul 2009 15:15:33 -0000
From: ddivulnalert@...frontline.com
To: bugtraq@...urityfocus.com
Subject: DDIVRT-2009-26 LogRover SQL Injection Authentication Bypass

Title
-----
DDIVRT-2009-26 LogRover SQL Injection Authentication Bypass

Severity
--------
Medium

Date Discovered
---------------
May 12, 2009

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Geoff Humes and r@...$

Vulnerability Description
-------------------------
The login screen of the LogRover web interface is vulnerable to a SQL Injection which can allow remote attackers to login to the system via an authentication bypass.

Solution Description
--------------------
Limit access to the login page to internal networks and trusted users only.

Tested Systems / Software (with versions)
------------------------------------------
LogRover version 2.3 for Windows XP

Vendor Contact
--------------
Name: LogRover
Website: http://www.logrover.com/