aeries browser interface(ABI) 3.8.3.14 Remote SQL Injection

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: aeries browser interface(ABI) 3.8.3.14 Remote SQL Injection
From: arsalan1991@xxxxxxxxx
Date: 25 Mar 2008 07:32:31 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

Discovered By : Arsalan Emamjomehkashan

aeries browser interface(ABI) 3.8.3.14 Remote SQL Injection

Website:http://aeries.com/
SQL injection:
GradebookOptions.asp?GrdBk=SQL
loginproc.asp If you post variable "SchlCode"
XSS:
UserName variable on loginproc.asp and usr on Login.asp

Prev by Date: [ GLSA 200803-32 ] Wireshark: Denial of Service
Next by Date: Re: Linksys phone adapter denial of service
Previous by thread: [ GLSA 200803-32 ] Wireshark: Denial of Service
Next by thread: [SECURITY] [DSA 1530-1] New cupsys packages fix multiple vulnerabilities
Index(es):
- Date
- Thread