| शीर्षक | Axios Italia Axios RE 1.7.0/7.0.0 REDefault.aspx DBIDX Connection String Parameter Pollution |
|---|
| विवरण | Connection String Parameter Pollution vulnerability found by changing DBIDX parameter in REDefault.aspx query. It is not filtered or sanitized, allowing attackers to change database connection string parameters. Accessing to ReStart.aspx (from one of school partners) and clicking on RE logo, we are redirected to REDefault.aspx, the vulnerable target, then to RELogin.aspx, which uses configuration parameters from the previous URL. Clicking on "Password dimenticata" (Password lost?) or "Accedi" (Login) we can see the details of exception thrown by ASP.NET. |
|---|
| स्रोत | ⚠️ https://family.sissiweb.it/Secret/REStart.aspx?Customer_ID=80008420434 |
|---|
| उपयोगकर्ता | ErPaciocco (UID 4004) |
|---|
| सबमिशन | 05/08/2019 10:25 PM (7 साल पहले) |
|---|
| संयम | 06/08/2019 07:48 AM (9 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 139528 [Axios Italia Axios RE 1.7.0/7.0.0 Connection REDefault.aspx DBIDX अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|