VUNET Case Manager Default.ASP SQL注入漏洞

VUNET Case Manager是一款基于ASP的WEB应用程序。 VUNET Case Manager不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'default.asp'脚本对用户提交的密码参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或可能操作数据库。 VUNET Case Manager 3.4 目前没有解决方案提供： http://vunet.us/casemanager.asp Password: anything' OR 'x'='x...

VUNET Case Manager 3.4 - default.asp SQL Injection

VUNET Case Manager 3.4 - default.asp SQL Injection source: https://www.securityfocus.com/bid/26523/info VUNET Case Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

[Aria-Security.Net] VU Case Manager "Username/Password" SQL Injection

Aria-Security Team, http://Aria-Security.net ------------------------------- Shout Outs: AurA, imm02tal Vendor: http://vunet.us Login Page Default.asp Password: anything' OR 'x'='x Regards, The-0utl4w Credits Goes To Aria-Security.Net...

VUNET Case Manager 3.4 - 'default.asp' SQL Injection

source: https://www.securityfocus.com/bid/26523/info VUNET Case Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or...

CVE-2006-6052

NetEpi Case Manager before 0.98 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2006-6052: Undefined Security Weakness

NetEpi Case Manager before 0.98 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2006-6052

NetEpi Case Manager before 0.98 generates different error messages depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames...

CVE-2006-6052

NetEpi Case Manager before 0.98 is affected by an information-disclosure vulnerability where authentication error messages differ for valid vs invalid usernames, enabling remote enumeration of valid usernames. The CVE details indicate a network-exposed issue with low attack complexity and partial...