Bugtraq mailing list archives
[eVuln] microBlog SQL Injection Vulnerability
From: alex () evuln com
Date: 17 Jan 2006 10:19:55 -0000
New eVuln Advisory: microBlog SQL Injection Vulnerability http://evuln.com/vulns/35/summary/bt/ --------------------Summary---------------- Software: microBlog Sowtware's Web Site: http://www.stamcar.com/projekti/microblog/ Versions: 2.0 RC-10 Critical Level: Moderate Type: SQL Injection Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) eVuln ID: EV0035 -----------------Description--------------- Vulnerable script: index.php Variables $month $year isn't properly sanitized before being used in a SQL query. This can be used to make any SQL query by injecting arbitrary SQL code. Administrator's login and password is threatened. --------------Exploit---------------------- Available at: http://evuln.com/vulns/35/exploit/bt/ --------------Solution--------------------- No Patch available.
Current thread:
- [eVuln] microBlog SQL Injection Vulnerability alex (Jan 17)