preben@watchcom.no
02/02/06, 06:15
Daffodil CRM does not properly sanities it's input’s on the login page;
http://www.SITE.com:8080/daffodilcrm/userlogin.jsp
Therefore SQL-injection attacks are possible.
PoC could be: 1'or'1'='1
Vendor’s homepage is: http://www.daffodildb.com/crm/
Please credit to: Preben Nyløkken
http://www.SITE.com:8080/daffodilcrm/userlogin.jsp
Therefore SQL-injection attacks are possible.
PoC could be: 1'or'1'='1
Vendor’s homepage is: http://www.daffodildb.com/crm/
Please credit to: Preben Nyløkken