Livingcolor Livingmailing LOGIN.ASP SQL Injection Vulnerability

Bugtraq ID:	13836
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2005 12:00AM
Updated:	Jun 01 2005 12:00AM
Credit:	Discovery is credited to Dj romty <[email protected]>.
Vulnerable:	livingcolor livingmailing 1.3
Not Vulnerable:

Livingcolor Livingmailing LOGIN.ASP SQL Injection Vulnerability

livingmailing is prone to an SQL injection vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'login.asp' script.

livingmailing 1.3 is reported vulnerable.

Livingcolor Livingmailing LOGIN.ASP SQL Injection Vulnerability

An exploit is not required.

The following proof of concept is available:
Username =admin
Password= ' or ''='

Livingcolor Livingmailing LOGIN.ASP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Livingcolor Livingmailing LOGIN.ASP SQL Injection Vulnerability

References:

• Home Page (livingcolor)
  
• livingmailing Input Validation Hole Lets Remote Users Inject SQL Commands (SecurityTracker)