|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Spooky Login Multiple HTML Injection Vulnerability
DoZ
HackersCenter.com
Date: Fri Dec 29 2006 - 17:03:02 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
This is a user management program where the users can register themselves by providing their username and passwords for protecting their webcontents. This program provide features like remembering login with cookies, automatic login, extended user info, expire user by date, admin can activate manually, registration page, tracks user logins, user can upload file, user can alter and add fields for user registration, users can login after expiry and more.
Advisory: Spooky Login Multiple HTML Injection Vulnerability
Hackers Center Security Group (http://www.hackerscenter.com)
Doz's Advisory
Risk: Medium to High
Vendor: www.spookylogin.com
Class: Input Validation Error
Vulnerable: 2.7
Exploit: Attackers can exploit these issues via a web client.
Remote: Yes
Local: Yes
XSS Hole:
/spooky/login/login.asp
/spooky/login/register.asp
SQL Hole"
/spooky/login/register.asp?UserUpdate=[sql]
/includes/a_register.asp
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]