BibORB 1.3.2 Login Module Multiple Parameter SQL Injection

2005-02-17T00:00:00
ID EDB-ID:25121
Type exploitdb
Reporter Patrick Hof
Modified 2005-02-17T00:00:00

Description

BibORB 1.3.2 Login Module Multiple Parameter SQL Injection. CVE-2005-0252. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/12583/info
   
   
BibORB is reported prone to multiple vulnerabilities arising from insufficient sanitization of user-supplied input. These issues can be exploited by a remote attacker to carry out cross-site scripting, HTML injection, SQL injection, directory traversal, and arbitrary file upload attacks.
   
These vulnerabilities are reported to affect BibORB version 1.3.2 and all previous versions. 

When logging in, use the following username and password:

Username: x' or 1=1 or login='x
Password: x') or 1=1 or password=md5('x