Aside switching from GET to a POST request, what is the difference here?
That the injection point to reach the vulnerable script is /index.php this
time? You say the php/lib/admin.php script and 'id' variable are
vulnerable in each advisory.
Do you really need to issue two advisories for the same vulnerability, or
do you not understand the concept fully? Could you kids at lease put the
script name in the Subject of your Bugtraq posts if you continue to do
this one advisory/mail per script crap? While you may think it gives the
appearance of more work and more vulnerabilities, most people that have
been in security for a few months recognize it as an immature advisory
practice as compared to one consolidated advisory with all of the issues.
Bonus points if you reply to any of my previous mails asking questions
about your pedestrian disclosures.
: Vulnerability ID: HTB22576
: Reference: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_tcms_2.ht
ml
: Vulnerability ID: HTB22571
: Reference: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_tcms.html
Aside switching from GET to a POST request, what is the difference here?
That the injection point to reach the vulnerable script is /index.php this
time? You say the php/lib/admin.php script and 'id' variable are
vulnerable in each advisory.
Do you really need to issue two advisories for the same vulnerability, or
do you not understand the concept fully? Could you kids at lease put the
script name in the Subject of your Bugtraq posts if you continue to do
this one advisory/mail per script crap? While you may think it gives the
appearance of more work and more vulnerabilities, most people that have
been in security for a few months recognize it as an immature advisory
practice as compared to one consolidated advisory with all of the issues.
Bonus points if you reply to any of my previous mails asking questions
about your pedestrian disclosures.
Sincerely,
OSVDB.org
[ reply ]