compozitSQL.txt

`Date:  
18:15 05/05/05  
  
  
  
Subject:  
"Compozit Webhosting Panel Administration Vulnerability"  
  
  
  
Vulnerable version:  
Compozit 1.0  
  
  
  
  
Description:  
Compozit is a France Webhosting that use Administration Panel to setup their website  
online.Have an Control Panel to upload,make a new directory,and modify web page.  
  
  
Vulnerability:  
The administration page is so vulnerability to get access admin privallage.  
Use SQL Injection in the form admin login,then we can run as Admininistration of website.  
User may upload malicious script,backdoors,trojan that can made run to the   
Administration system computer.  
  
Sample of client :  
http://www.xxxx-cherbourg.fr/fr/admin/  
On the login form use SQL Injection:  
  
login : admin  
Pass : 'or '='  
  
W00t! we have g0t Admin land...  
  
  
  
Solution:  
Vendor had being contact  
  
  
  
Vendor URL:  
http://www.compozit.fr  
  
  
  
Credits:  
Published by - basher13[[email protected]]  
--   
`