|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  ExploitAlert Database |
||
ExploitAlert : 4724 SecurityAlert : 4287 (Exploit Details) Milw0rm ID : 6490 Credit : Neo Anderson & Rohit Bansal Date : 19.09.2008 Exploit Code : ============================================================ AssetMan v2.5-b SQL Injection using Session Fixation Attack ============================================================ ; , ,; '. ;: :; :: :: :: :: ': : :. : ;' :: :: ' .' '; ;' '. :: :; ;: :: ; :;. ,;: :: :; :;: ,;" :: ::. ':; ..,.; ;:' ,.;: "'"... '::,::::: ;: .;.;""' '"""....;:::::;,;.;""" .:::.....'"':::::::'",...;::::;. ;:' '""'"";.,;:::::;.'"""""" ':; ::' ;::;:::;::.. :; :: ,;:::::::::::;:.. :: ;' ,;;:;::::::::::::::;";.. ':. :: ;:" ::::::"""':::::: ": :: :. :: ::::::; ::::::: : ; ; :: ::::::: ::::::: : ; ' :: ::::::....:::::' ,: ' ' :: :::::::::::::" :: :: ':::::::::"' :: ': """""""' :: :: ;: ':; ;:" '; ,;' "' '" ' AUTHOR : Neo Anderson & Rohit Bansal DATE : 19th Sept,2008 Email : neo.whizzy@gmail.com & rohitisback@gmail.com ##################################################### # Site : http://www.bctree.com/~assetman # Bug : SQL Injection using Session Fixation Attack # File : search_inv.php # Variable : GET variable 'order_by' ##################################################### # Impact of Vulnerability: By exploiting this vulnerability, an attacker may conduct a session fixation attack. In a session fixation attack, the attacker fixes the user's session ID before the user even logs into the target server, thereby eliminating the need to obtain the user's session ID afterwards. ##################################################### # Bug explanation - Session Fixation Attack/Meta Tag Exploitation: By injecting a custom HTTP header or by injecting a META tag, it is possible to alter the cookies stored in the browser. Attackers will normally manipulate cookie values to fraudulently authenticate themselves on a web site. ##################################################### # PoC: http://127.0.0.1/assetman/search_inv.php?action=search_all&order_by=%3Cmeta +http-equiv='Set-cookie'+content='=value'%3E&order=DESC+limit+1,1-- ##################################################### # GreeTz InfySec , str0ke & EvilFingers www.infysec.com www.evilfingers.com ##################################################### Feedback : If you have additional information or notice any errors regarding this exploit, please use contact form or email us at exploit()securityreason()com. |
||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
» PHP 5.2.12/5.3.1 |
||
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |