Active News Manager LOGIN.ASP SQL Injection Vulnerability

Bugtraq ID:	13759
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 25 2005 12:00AM
Updated:	May 25 2005 12:00AM
Credit:	Discovery is credited to Romty (Morteza Panahi).
Vulnerable:	Active News Manager Active News Manager
Not Vulnerable:

Active News Manager LOGIN.ASP SQL Injection Vulnerability

Active News Manager is prone to an SQL injection vulnerability. This issue affects the 'login.asp' script.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker can gain unauthorized access to an affected site.

All versions are considered to be vulnerable at the moment.

Active News Manager LOGIN.ASP SQL Injection Vulnerability

An exploit is not required.

The following proof of concept is available:
Uername =admin
Password= ' or ''='

Active News Manager LOGIN.ASP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Active News Manager LOGIN.ASP SQL Injection Vulnerability

References:

• Active News Manager (Romty (Morteza Panahai))
  
• Active News Manager (Dotnetindex)