Re: Sql injection in jPortal version 2.3.1 (module banner)

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: Sql injection in jPortal version 2.3.1 (module banner)
From: exon <exon@xxxxxxx>
Date: Mon, 13 Jun 2005 23:08:44 +0200
In-reply-to: <20050612212245.32752.qmail@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <20050612212245.32752.qmail@xxxxxxxxxxxxxxxxx>
User-agent: Mozilla Thunderbird 1.0.2-1.3.3 (X11/20050513)

anonymous@xxxxx wrote:

"After that, You gain login and password of administrator."

Bull shit.
In 2.3.1 version an admin password is "hashed". You gain "f95aead0f1f7481cf4d4acfe61c10fce" instaed password.


It's still a Bad Thing(tm). See http://www.openwall.com/john for details.

References:
- Re: Sql injection in jPortal version 2.3.1 (module banner)
  - From: anonymous

Prev by Date: is this new? vuln info @ Adobe
Next by Date: [USN-140-1] Gaim vulnerability
Previous by thread: Re: Sql injection in jPortal version 2.3.1 (module banner)
Next by thread: Directory transversal, sql injection and xss vulnerabilities in RadBids Gold v2
Index(es):
- Date
- Thread