Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Cross-Site Scripting vulnerability in E107

From:crashbrz_(at)_gmail.com <crashbrz_(at)_gmail.com>
Date:24 сентября 2009 г.
Subject:Engeman - SQL Injection Vulnerability (vendor url erratum)

Engeman is a Brasilian software for maintenance control.

Version tested: 6.x.x and prior. Next versions appears vulnerable too.

The attacker can inject sql codes in username  textbox:

SQL dump affter injection:

select nome,senha,diasexp,dataltsen,permitetroca from cfgusr where nome='NULL' OR NOME<>'1'

select nomegrupo from cfgusr where ignoragrupo='N' and nome='NULL' OR NOME='1'

In firebird the attack have a low impact, but in SQL Server may compromisse the server.

**** The version tested is a made in DELPH language, NOT is a Web Software! ****

Vendor site: www.engeman.com.br.

Plase, give the credits to: Crash and _Sl0t_ - DcLabs

Trank´s.

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород