mailing list archives
XSS and SQL Injection in Election Commision of India website (now fixed)
From: Ajay Pal Singh Atwal <ajaypal () bbsbec org>
Date: Mon, 12 Mar 2007 12:16:37 +0530 (IST)
Election Commission of India website had XSS and SQL injection vulnerabilities.
The vulnerabilities were reported on 2nd of March to ECI and on 4th March to CERT-IN, for the following URL:
The above script is used to display detailed results of a given constituency.
On 9th March 2007 Election Commission of India Fixed (disabled parts of) their website to avoid XSS and SQL injection
vulnerabilities after intervention of CERT-IN.
Still a bit of usually harmless data insertion is possible.
Ajay Pal Singh Atwal
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- XSS and SQL Injection in Election Commision of India website (now fixed) Ajay Pal Singh Atwal (Mar 12)