Accelerated Mortgage Manager Password Field SQL Injection Vulnerability

Bugtraq ID:	15097
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 13 2005 12:00AM
Updated:	Oct 13 2005 12:00AM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	Accelerated Mortgage Manager Accelerated Mortgage Manager 0
Not Vulnerable:

Accelerated Mortgage Manager Password Field SQL Injection Vulnerability

Accelerated Mortgage Manager is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before passing it on to SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Accelerated Mortgage Manager Password Field SQL Injection Vulnerability

No exploit is required.

An example has been provided:

Username =admin
Password= ' or ''='

Accelerated Mortgage Manager Password Field SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Accelerated Mortgage Manager Password Field SQL Injection Vulnerability

References:

• Accelerated Mortgage Manager Web Page (Accelerated Mortgage Manager)
  
• Andysheh Soltani's Web Site ([email protected])