[38798] in bugtraq
WowBB view_user.php SQL Injection Vulnerability
daemon@ATHENA.MIT.EDU (Megasky)
Tue May 10 19:31:11 2005
Date: 10 May 2005 11:06:26 -0000
Message-ID: <20050510110626.22120.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Megasky <magasky@hotmail.com>
To: bugtraq@securityfocus.com
An attacker can exploit this vulnerability to gain admin username and password.
http://www.wowbb.com/
Vulnerable versions: 1.6
1.61
1.62
Proof of concept:
http://www.example.com/wowbb/view_user.php?list=1&letter=&sort_by='[SQL Injection]
