Topic:	Maian Support Authentication Bypass
Credit:	alex evuln com
Date:	2006.03.29
CWE:	N/A
CVE:	CVE-2006-1259 (Show details) Use CVE to see details like: - CVSS2, - Affected Software, - References

New eVuln Advisory:
Maian Support Authentication Bypass
http://evuln.com/vulns/103/summary.html

--------------------Summary----------------
eVuln ID: EV0103
CVE: CVE-2006-1259
Software: Maian Support
Sowtware's Web Site: http://www.maianscriptworld.co.uk/
Versions: 1.0
Critical Level: Moderate
Type: SQL Injection
Class: Remote
Status: Unpatched. Developer(s) contacted.
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
Vulnerable script: admin/index.php

Parameters email, pass are not properly sanitized before being used in SQL query. This can be used to bypass
authentication using SQL injection or make any SQL query by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off

--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/103/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.