full-disclosure - Compozit Webhosting Panel Administration Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050505111649.F10C423EF70@ws5-4.us4.outblaze.com>
Date: Thu May  5 12:19:03 2005
From: basher13 at linuxmail.org (eric basher)
Subject: Compozit Webhosting Panel Administration
	Vulnerability

Date:
18:15 05/05/05

Subject:
"Compozit Webhosting Panel Administration  Vulnerability"

Vulnerable version:
Compozit 1.0

Description:
Compozit is  a France Webhosting that use Administration Panel to setup their website
online.Have an Control Panel to upload,make a new directory,and modify web page.

Vulnerability:
The administration page is so vulnerability to get access admin privallage.
Use SQL Injection in the form admin login,then we can run as Admininistration of website.
User may upload malicious script,backdoors,trojan that can made run to the 
Administration system computer.

Sample of client :
http://www.xxxx-cherbourg.fr/fr/admin/
On the login form use SQL Injection:

login : admin
Pass : 'or '='

W00t! we have g0t Admin land...

Solution:
Vendor had being contact

Vendor URL:
http://www.compozit.fr

Credits:
Published by - basher13[basher13@...uxmail.org]
-- 
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze