lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 28 Dec 2009 00:32:58 -0700
From: faghani@...c.ir
To: bugtraq@...urityfocus.com
Subject: Sheedravi CMS SQL Injection Vulnerability

                 
================= IUT-CERT =================

Title: Sheedravi CMS SQL Injection Vulnerability

Vendor: www.sheedravi.com

Dork: Design by Sheed Graphic Co
Type: Input.Validation.Vulnerability (SQL Injection)

Fix: N/A

================== nsec.ir =================

Description:

------------------

Sheedravi is a CMS producer in Iran. /template1/advancedsearch.aspx page in Sheedravi CMS

product are vulnerable to SQL Injection vulnerability.

Vulnerability Variant:

------------------
Injection "/template1/advancedsearch.aspx.aspx" in "txtAdvancedkeyword" POST parameter
value:' or 1=1;--
      '
      <script>
and,...


Solution:

------------------

Input validation of "txtAdvancedkeyword" POST parameter  should be corrected.

Credit:

------------------

Isfahan University of Technology - Computer Emergency Response Team

Thanks to : M. Fereidounian, M. R. Faghani, N. Fathi,E. Jafari

Powered by blists - more mailing lists