CVE-2008-6366
published 2009-03-02CVE-2008-6366: SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
3.35%
87.2th percentile
SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, possibly related to the uname and pass parameters to logon_process.jsp. NOTE: some of these details are obtained from third party information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adserversolutions | affiliate_software_java | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Affiliate Software Java 4.0 - Authentication Bypass
exploitdb·2008-12-11
CVE-2008-6366 Affiliate Software Java 4.0 - Authentication Bypass
Affiliate Software Java 4.0 - Authentication Bypass
---
[☢] ☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢{بسم الله الرØمن الرØيم}☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢
[~] Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
[~] Vendor: www.adserversolutions.com
[☠] Software: Affiliate Software Java 4.0
[☠] author: ((Ñ3d D3v!L))
[☠] Date: 12.12.2008
[☠] Home: www.ahacker.biz
[☠] contact: N/A
[☠] ☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠{DEV!L'5 of SYST3M}☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠☠â˜
[☠] Exploit:
☠username: r0' or ' 1=1--
☠password: r0' or ' 1=1--
[☠]login 4 d3m0:
http://www.ad
Exploit-DB
Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
exploitdb·2008-12-11
CVE-2008-6366 Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
---
source: https://www.securityfocus.com/bid/32782/info
Multiple Ad Server Solutions products are prone to SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The following Ad Server Solutions products are vulnerable:
Ad Management Software
Affiliate Software
The following example data is available:
username: r0' or ' 1=1--
password: r0' or ' 1=1--
No writeups or analysis indexed.
http://packetstorm.linuxsecurity.com/0812-exploits/affiliatesj-sql.txthttp://secunia.com/advisories/33072http://www.securityfocus.com/bid/32791https://exchange.xforce.ibmcloud.com/vulnerabilities/47280https://www.exploit-db.com/exploits/7423http://packetstorm.linuxsecurity.com/0812-exploits/affiliatesj-sql.txthttp://secunia.com/advisories/33072http://www.securityfocus.com/bid/32791https://exchange.xforce.ibmcloud.com/vulnerabilities/47280https://www.exploit-db.com/exploits/7423
2009-03-02
Published