Vulners
Lucene search
Infoproject Biznis Heroj (login.php) Authentication Bypass Vulnerability
| Reporter | Title | Published | Views | Family All 5 |
|---|---|---|---|---|
 | CVE-2011-5039 | 30 Dec 201119:00 | – | cve |
 | CVE-2011-5039 | 30 Dec 201119:00 | – | cvelist |
 | EUVD-2011-4942 | 7 Oct 202500:30 | – | euvd |
 | CVE-2011-5039 | 30 Dec 201119:55 | – | nvd |
 | Sql injection | 30 Dec 201119:55 | – | prion |
<html><body><p>Infoproject Biznis Heroj (login.php) Authentication Bypass Vulnerability
Vendor: Infoproject DOO
Product web page: http://www.biznisheroj.mk
Affected version: Plus, Pro and Extra
Summary: Biznis Heroj or Business Hero (������ ����) is the first
software on the Macedonian market that will help you manage your
business processes in your company, such as accounting, production,
acquisition, archiving, inventory, and the Cloud. Using the Cloud
technology, Biznis Heroj allows you to access the system from any
computer at any time through any internet browser.
Desc: The vulnerability is caused due to an error in the logon
authentication script (login.php) and can be exploited to bypass
the login procedure by defining the 'username' and 'password' POST
parameters with an SQL Injection attack, gaining admin privileges.
Tested on: Apache, PHP
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com
Vendor status:
[14.12.2011] Vulnerability discovered.
[15.12.2011] Contact with the vendor.
[20.12.2011] No response from the vendor.
[21.12.2011] Public security advisory released.
Advisory ID: ZSL-2011-5065
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5065.php
14.12.2011
---
PoC:
https://[TARGET]/login.php
Username: ' or 1=1--
Password: ' or 1=1--
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Dec 2011 00:00Current
5.9Medium risk
Vulners AI Score5.9
CVSS 27.5
EPSS0.00775