full-disclosure - Idea cellular (ideacellular.com) SQL Injection vulnerability in Corporate Account Login

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <15a22f450903240649x52e27295m84ca6bd464991224@mail.gmail.com>
Date: Tue, 24 Mar 2009 19:19:47 +0530
From: null null <giimale@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Idea cellular (ideacellular.com) SQL Injection
	vulnerability in Corporate Account Login

Hi,


Organization
-------------------
http://ideacellular.com
Idea Cellular, Aditya Birla Group
It is one of the major telecom companies in India.


Problem
-------------
Sql injection in Corporate Account Login

Dates
--------------
Reported: 17th March 2009
Fixed:       23rd March 2009

Credits
----------
Aseem Jakhar - Member NULL security community
http://null.co.in

Problem Description
-----------------------------
There was a sql injection vulnerability in the corporate Account
login on the ideacellular.com website. They were doing client side
validation only, which could be easily bypassed. It could lead to
unauthorized access and database manipulation.


--
Cheers,
@
http://null.co.in

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/