Thursday, 17 December 2009

Universal College(http://www.uc.edu.np) SQL injection Vuln

A sql Injection Vuln exists in Universal College's site. A remote attacker can easily get the pwd and login.

Some details:

Vuln Type: SQL injection

FTP: ftp://ftp.uc.edu.np/ (Proftpd 1.3.0 server//WL)

VULN RATING: 6/10 (SQL INJECTION), 8/10 (OLD FTP SERVER. MANY EXPLOITS ARE OUT THERE)

STATUS:Notified

Some proofs:

Table_names: login, user

Dumps:

Not_REVEALED for security

Screenshot of Logged in cpanel:
Hope they fix it down :D

Posted by at

2 comments:

  1. Cool Samar17 December 2009 at 18:50

    good job, bro. nepali developers need to learn how to prevent themselves from getting owned.

    ReplyDelete
  2. dARK_pHOENIX18 December 2009 at 02:02

    Thnx bro, but the more severe problem lies in the ftp server of wliink. They still use the damn old proftpd 1.3.0 and see there are lots of scripts available to exploit it. Even a n00b script kiddie can exploit that.
    They must use recent version. I think the best is Pure-FTPD [TLS] which is a freeware.Why r they hesitating to upgrade i don't understand.

    ReplyDelete

Subscribe to: Post Comments (Atom)