Online Dating Software by AEwebworks - aeDating Script <= 4.0 Version Vulnerability

alexsrb_at_netsite.com
Date: 09/15/05

  • Next message: ak_at_red-database-security.com: "Oracle Reports: Generic SQL Injection Vulnerability via Lexical References" 
    Date: 15 Sep 2005 11:27:40 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is) Online Dating Software by AEwebworks - aeDating Script <= 4.0 Version

    I have found Vulnerability in Online Dating Software by AEwebworks - aeDating Script <= 4.0 version which is exploitable when you are searching for your soulmate at aeDating service Software.

    For example :
    www.[target].com/search.php just choose one Country and click on the Search button , After having done that you can see something like this :

    www.target.com/search_result.php?Sex=male&LookingFor=female&DateOfBirth_start=18&DateOfBirth_end=40&Country%5B%5D=0

    And at this instant to complete it all, all you have to do is add something of your individual choosing at the end of the link for an example UNION

    www.target.com/search_result.php?Sex=male&LookingFor=female&DateOfBirth_start=18&DateOfBirth_end=40&Country%5B%5D=0UNION

    And search result:

    Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/site/public_html/search_result.php on line 370

    ERROR Database access error

    Best Regards
    Alex

  • Next message: ak_at_red-database-security.com: "Oracle Reports: Generic SQL Injection Vulnerability via Lexical References"
    • Quantcast