AOH :: HP Unsorted S :: C07-1526.HTM

Spooky Login Multiple HTML Injection Vulnerability



Spooky Login Multiple HTML Injection Vulnerability
Spooky Login Multiple HTML Injection Vulnerability



This is a user management program where the users can register themselves by providing their username and passwords for protecting their webcontents. This program provide features like remembering login with cookies, automatic login, extended user info, expire user by date, admin can activate manually, registration page, tracks user logins, user can upload file, user can alter and add fields for user registration, users can login after expiry and more.


Advisory: Spooky Login Multiple HTML Injection Vulnerability


Hackers Center Security Group (http://www.hackerscenter.com) 
Doz's Advisory


Risk: Medium to High
Vendor: www.spookylogin.com 
Class: Input Validation Error


Vulnerable: 2.7

Exploit: Attackers can exploit these issues via a web client.


Remote: Yes
Local: Yes


XSS Hole:

/spooky/login/login.asp

/spooky/login/register.asp



SQL Hole"


/spooky/login/register.asp?UserUpdate=[sql]


/includes/a_register.asp

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.