Bugtraq: Multiple SQL Injections in MetaBid Auctions

[dcrab <dcrab () hackerscenter com>]

Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. 
Learn more at http://www.digitalparadox.org/services.ah

Severity: High
Title: Multiple SQL Injections in MetaBid Auctions
Date: 27/04/2005

Vendor: MetaLinks
Vendor Website: www.metalinks.com
Summary: There are, multiple sql injections in metabid auctions.


Proof of Concept Exploits: 

MetaBid Auctions
http://example.com/metabid/logIn.asp
Both Username and Password fields are vulnerable to sql injections that 
can be used to bypass authentication
SQL INJECTION AND AUTHENTICATION BYPASS


http://example.com/metabid/item.asp?intAuctionID='SQL_INJECTION
SQL INJECTION


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: 
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact 
me regarding these vulnerabilities. You can find me at, 
http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my 
soon to come out book on Secure coding with php.