Sponsored Content
Special Forums Cybersecurity Security Advisories (RSS) Debian: 2030-1: mahara: sql injection Post 302410719 by Linux Bot on Tuesday 6th of April 2010 04:00:01 PM
Old 04-06-2010
Debian: 2030-1: mahara: sql injection

LinuxSecurity.com: It was discovered that mahara, an electronic portfolio, weblog, and resume builder is not properly escaping input when generating a unique username based on a remote user name from a single sign-on application. An attacker can use this to compromise the mahara database via crafted user names. [More...]

More...
 

We Also Found This Discussion For You

1. Shell Programming and Scripting

SQL Injection Detection

I want to grep/awk /var/log/httpd/mysite-access_log.log and check if 2 words from the following appear in a single line: benchmark union information_schema drop truncate group_concat into file case hex lpad group order having insert union select from (12 Replies)
Discussion started by: koutroul
12 Replies
THEMOLE(1)						      General Commands Manual							THEMOLE(1)

NAME
themole - automatic SQL injection exploitation tool SYNOPSIS
themole [ -h ] [ -u url ] [ -n needle ] [-t num_threads] DESCRIPTION
The Mole is a command line interface SQL Injection exploitation tool. This application is able to exploit both union-based and blind bool- ean-based injections. Every action The Mole can execute is triggered by a specific command. All this application requires in order to exploit a SQL Injection is the URL(including the parameters) and a needle(a string) that appears in the server's response whenever the injection parameter generates a valid query, and does not appear otherwise. OPTIONS
-h Shows the help message and exits. -u url Sets the url of the mole's instance to url. -n needle Sets the needle of the mole's instance to needle. It must be a string that appears when the injection returns true and disappears when the injection is false. -t threads Sets the max number of concurrent requests that the mole will be making. Cannot be changed at runtime. SEE ALSO
The program provides interactive documentation, refer also to the official README file. AUTHOR
This manual page was written by Santiago Alessandri <salessandri@nasel.com.ar> November 24 2011 THEMOLE(1)
All times are GMT -4. The time now is 03:04 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy