1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Home
  2. Security
  3. Security Lab
  4. Latest Threats
  5. Vulnerability Descriptions
  6. SA33103

ASP-DEv Internal E-Mail System "login" and "password" SQL Injection

Report ID: SA33103
Source: Secunia
Date of Discovery: 15.12.2008
Criticality: Moderate
Affects:
Internal E-Mail System
Compromise From: From local network
Compromise Type: Security bypass
Manipulation of data

Summary

Some vulnerabilities in ASP-DEv Internal E-Mail System, which can be exploited by malicious people to conduct SQL injection attacks.

Detailed Description

Some vulnerabilities in ASP-DEv Internal E-Mail System, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "login" and "password" parameters in login.asp is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows bypassing the authentication mechanism.

Solution

Edit the source code to ensure that input is properly sanitised.