Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Multiple SQL Injections in MetaBid Auctions

from [dcrab] Network Security [Permanent Link]
Subject: Multiple SQL Injections in MetaBid Auctions
Date: 26 Apr 2005 21:37:23 -0000 


Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. 
Learn more at http://www.digitalparadox.org/services.ah

Severity: High
Title: Multiple SQL Injections in MetaBid Auctions
Date: 27/04/2005

Vendor: MetaLinks
Vendor Website: www.metalinks.com
Summary: There are, multiple sql injections in metabid auctions.


Proof of Concept Exploits: 

MetaBid Auctions
http://example.com/metabid/logIn.asp
Both Username and Password fields are vulnerable to sql injections that 
can be used to bypass authentication
SQL INJECTION AND AUTHENTICATION BYPASS


http://example.com/metabid/item.asp?intAuctionID='SQL_INJECTION
SQL INJECTION


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: 
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact 
me regarding these vulnerabilities. You can find me at, 
http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my 
soon to come out book on Secure coding with php.
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • Multiple SQL Injections in MetaBid Auctions, dcrab <=
Previous by Date:  MetaCart2 for PayFlow Multiple Sql Injection Vulnerabilities, dcrab
Next by Date:  E-Cart E-Commerce Software EXPLOIT, Emanuele \"z\\\" Gentili
Previous by Thread:  MetaCart2 for PayFlow Multiple Sql Injection Vulnerabilities, dcrab
Next by Thread:  E-Cart E-Commerce Software EXPLOIT, Emanuele \"z\\\" Gentili
Indexes:  [Date] [Thread] [Top] [All Lists]