We care We really really do -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of null null Sent: 24. marts 2009 14:50 To: [email protected] Subject: [Full-disclosure] Idea cellular (ideacellular.com) SQL Injectionvulnerability in Corporate Account Login
Hi, Organization ------------------- http://ideacellular.com Idea Cellular, Aditya Birla Group It is one of the major telecom companies in India. Problem ------------- Sql injection in Corporate Account Login Dates -------------- Reported: 17th March 2009 Fixed: 23rd March 2009 Credits ---------- Aseem Jakhar - Member NULL security community http://null.co.in Problem Description ----------------------------- There was a sql injection vulnerability in the corporate Account login on the ideacellular.com website. They were doing client side validation only, which could be easily bypassed. It could lead to unauthorized access and database manipulation. -- Cheers, @ http://null.co.in _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
