Bugtraq mailing list archives
Spooky Login Multiple HTML Injection Vulnerability
From: DoZ () HackersCenter com
Date: 29 Dec 2006 23:03:02 -0000
This is a user management program where the users can register themselves by providing their username and passwords for protecting their webcontents. This program provide features like remembering login with cookies, automatic login, extended user info, expire user by date, admin can activate manually, registration page, tracks user logins, user can upload file, user can alter and add fields for user registration, users can login after expiry and more. Advisory: Spooky Login Multiple HTML Injection Vulnerability Hackers Center Security Group (http://www.hackerscenter.com) Doz's Advisory Risk: Medium to High Vendor: www.spookylogin.com Class: Input Validation Error Vulnerable: 2.7 Exploit: Attackers can exploit these issues via a web client. Remote: Yes Local: Yes XSS Hole: /spooky/login/login.asp /spooky/login/register.asp SQL Hole" /spooky/login/register.asp?UserUpdate=[sql] /includes/a_register.asp
Current thread:
- Spooky Login Multiple HTML Injection Vulnerability DoZ (Jan 01)