Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Date: Fri Dec 07 2007 - 13:25:02 CST
Found by: Jaakko "Chrysalid" Hartikainen
Kvaliitti WebDoc 3.0 CMS is a proprietary Finnish-made content management system developed by Kvaliitti Oy (http://www.kvaliitti.fi). It is driven by MS SQL Server and ASP.
WebDoc 3.0 suffers from a flaw in input validation, which allows attackers to insert malicious SQL queries into an existing one, possibly gaining complete control over an affected system.
3. Vulnerable files & PoC:
categories.asp, subcategory.asp, document_id, cat_id
This proof of concept example exposes the internal server variable called "version":
Vendor notified: yes