RETIRED: Pay Roll Time Sheet & Punch Card Login SQL Injection Vulnerability
BID:44609
Info
RETIRED: Pay Roll Time Sheet & Punch Card Login SQL Injection Vulnerability
| Bugtraq ID: | 44609 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 02 2010 12:00AM |
| Updated: | Nov 08 2010 07:07PM |
| Credit: | L0rd CrusAd3r |
| Vulnerable: |
CodeWidgets Pay Roll Time Sheet & Punch Card 1.0 |
| Not Vulnerable: | |
Discussion
RETIRED: Pay Roll Time Sheet & Punch Card Login SQL Injection Vulnerability
Pay Roll Time Sheet & Punch Card is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Pay Roll Time Sheet & Punch Card 1.0 is vulnerable; other verisons may also be affected.
NOTE: This BID has been retired because it is a duplicate of BID 25114 (Pay Roll Time Sheet and Punch Card Application With Web UI Login.ASP SQL Injection Vulnerability).
Pay Roll Time Sheet & Punch Card is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Pay Roll Time Sheet & Punch Card 1.0 is vulnerable; other verisons may also be affected.
NOTE: This BID has been retired because it is a duplicate of BID 25114 (Pay Roll Time Sheet and Punch Card Application With Web UI Login.ASP SQL Injection Vulnerability).
Exploit / POC
RETIRED: Pay Roll Time Sheet & Punch Card Login SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example data is available :
Inject the following into the login options field.
' or 1=1 or ''='
Attackers can use a browser to exploit this issue.
The following example data is available :
Inject the following into the login options field.
' or 1=1 or ''='
Solution / Fix
RETIRED: Pay Roll Time Sheet & Punch Card Login SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: Pay Roll Time Sheet & Punch Card Login SQL Injection Vulnerability
References:
References:
- Pay Roll Time Sheet & Punch Card Homepage (CodeWidgets)