Unu hits Kaspersky

[Pradip Sharma <sharma.pradip () gmail com>]

Unu has done a great job again this time. He should make the Kaspersky known
to this issue before making the vulnerability public. I think he did so. The
site was at risk and so were many users. How these big sites are potentially
vulnerable to different attacks!!

Regards,
Pradip

Unu, who has gained a good deal of attention lately, is known for his
vulnerability disclosures that center on SQL Injection. In his latest
adventures, he returns to a vendor he has targeted in the past, security
software specialist Kaspersky.

In February, Unu went public on HackersBlog and disclosed the SQL Injection
flaws he had discovered on Kaspersky’s USA portal. The flaws, which led to
complete access to users, activation codes, lists of bugs, admins, shopping,
etc., were quickly patched, and Kaspersky was quick to point out that,
“despite their attempts, the hackers were unable to gain access to
restricted information stored on the website. Claims by the hackers
responsible for the attack that they had managed to gain access to user data
are untrue.”

Read more:
http://www.thetechherald.com/article.php/200950/4931/Unu-hits-Kaspersky-a-second-time-with-SQL-Injection-disclosure#ixzz0ZZIWR9U7

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/