Netchemia oneSCHOOL 'login.asp' SQL注入漏洞

Netchemia oneSCHOOL是一款基于ASP的WEB应用程序。 Netchemia oneSCHOOL不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'login.asp'脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Netchemia oneSCHOOL 目前没有解决方案提供： http://www.netchemia.com/ http://sebug.net/exploit/2877/...

CVE-2007-4106

SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4095

SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp...

nukeditXSS.txt

Title : Nukedit Login.ASP Cross-Site Scripting Vulnerability Description : Nukedit is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Software : http://www.nukedit.com/ Author : d3hydr8 Contact : d3hydr8atgmaildotcom Original...

Unfixed XSS vulnerability at www.pcmercato.it

Security researcher By Encore, has submitted on 06/04/2007 a cross-site-scripting XSS vulnerability affecting www.pcmercato.it, which at the time of submission ranked 1816954 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/04/2007. It is...

Sql injection

SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection aka RBL - ASP allows remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters...

CVE-2007-0784

SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection aka RBL - ASP allows remote attackers to execute arbitrary SQL commands via the 1 User and 2 Password parameters...

CVE-2007-0784

The CVE-2007-0784 entry describes a SQL injection in login.asp of the Raymond BERTHOU script collection (RBL - ASP). The vulnerability allows remote attackers to execute arbitrary SQL commands through the User and Password parameters, due to improper handling in the login routine. This is a serve...

CVE-2007-0575

Multiple SQL injection vulnerabilities in the administrative login page admin/login.asp in ASPCode.net AdMentor allow remote attackers to execute arbitrary SQL commands via the 1 Userid and 2 Password fields...

CVE-2006-6846

Multiple SQL injection vulnerabilities in While You Were Out WYWO InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the num parameter in a phonemessage.asp, 2 the catcode parameter in b faqDsp.asp, and the 3 Username and 4 Password fields in c login.asp...

CVE-2006-6846

Multiple SQL injection vulnerabilities in While You Were Out WYWO InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the num parameter in a phonemessage.asp, 2 the catcode parameter in b faqDsp.asp, and the 3 Username and 4 Password fields in c login.asp...

CVE-2006-6543

Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 login UserName and possibly 2 password parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-6543

Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 login UserName and possibly 2 password parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-6543

CVE-2006-6543 affects AppIntellect SpotLight CRM 1.0, specifically the login.asp component. The vulnerability is described as multiple SQL injection flaws that allow an attacker to execute arbitrary SQL commands through the (1) login (UserName) parameter and potentially (2) the password parameter...

SpotLight CRM 1.0 - login.asp SQL Injection

SpotLight CRM 1.0 - login.asp SQL Injection Title : SpotLight CRM 1.0 login.asp | Remote SQL Injection Vulnerability Author : ajann Contact : : $$$ : $2,499 SQL http://target/path//login.asp=POST SQL Example: - All User UserName And Password Changed "kro" // login.asp UserName: ';update login set...

SpotLight CRM 1.0 (login.asp) Remote SQL Injection Vulnerability

No description provided by source. Title : SpotLight CRM 1.0 login.asp | Remote SQL Injection Vulnerability Author : ajann Contact : : $$$ : $2,499 SQL http://target/path//login.asp=POST SQL Example: - All User UserName And Password Changed "kro" // login.asp UserName: ';update login set...

SpotLight CRM 1.0 - 'login.asp' SQL Injection

Title : SpotLight CRM 1.0 login.asp | Remote SQL Injection Vulnerability Author : ajann Contact : : $$$ : $2,499 SQL http://target/path//login.asp=POST SQL Example: - All User UserName And Password Changed "kro" // login.asp UserName: ';update login set password='kro'-- // login.asp UserName:...

SpotLight CRM 1.0 (login.asp) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================ SpotLight CRM 1.0 login.asp Remote SQL Injection Vulnerability ================================================================ Title : SpotLight CRM 1.0 login.asp | Remote S...

CVE-2006-6399

CVE-2006-6399 concerns Superfreaker Studios UPublisher 1.0, where a SQL injection flaw in the login.asp Username parameter allows remote execution of arbitrary SQL commands. The vulnerability is described across multiple sources (NVD, Red Hat, CVE List) with the same core detail, but no concrete ...

CVE-2006-6260

SQL injection vulnerability in login.asp in Redbinaria Sistema Integrado de Administracion de Portales SIAP allows remote attackers to execute arbitrary SQL commands via the username parameter...