OSVDB ID: 16912 Title: os4e login.asp Password Field SQL Injection |
Info |
|
|
Dates |
||||
|
|
Description |
os4e contains a flaw that may allow an attacker to inject arbitrary SQL queries. The issue is due to the "Password" variable in the "login.asp" script not being properly sanitized and may allow an attacker to inject or manipulate SQL queries. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Information Disclosure, Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Available Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
|
References |
|
Credit |
|
yahoo.com -