Info

Disclosure

Apr 04, 2005

Discovery

Unknown

Dates

Exploit

Apr 04, 2005

Solution

Unknown

Description

Ocean12 Membership Manager contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the the 'UserID' variable in the main.asp script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries.

Classification

Location: Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Available
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Ocean12 Technologies

Membership Manager Pro

Unknown or Unspecified

References

Security Tracker: 1013667
Bugtraq ID: 13049
Secunia Advisory ID: 14864
Related OSVDB ID: 15306
ISS X-Force ID: 20015
CVE ID: 2005-1096 (see also: NVD)
Other Advisory URL: http://osvdb.org/ref/15/1530x-ocean12-multiple.txt
http://www.hackerscenter.com/archive/view.asp?id=1865
Vendor URL: http://www.ocean12scripts.com/

Credit

Zinho - zinhohackerscenter.com - Hackers Center

Direct URL: http://osvdb.org/36218