exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files

Zero Day Initiative Advisory 10-225

Posted Oct 28, 2010

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 10-225 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdPageImlogic.aspx page which is exposed through an IIS extension on the default web server port. By setting the 'rdReport' argument to the value 'DetailReportGroup' an attacker can force the server to load the DetailReportGroup.lgx definition file. This file contains SQL injections within multiple parameters. An attacker can abuse this to inject arbitrary SQL statements to be evaluated by the back-end database.

tags | advisory, remote, web, arbitrary, sql injection

advisories | CVE-2010-0112

SHA-256 | 7178e80358422215dfcb5e13ab812b85882bff6721703e9d1f5c9201442d1865

Download | Favorite | View