Loading....
- Apocalipsa dupa Nemessis
- Cand dorinta de afirmare depaseste granitele bunului simt – PaxNwo un leecher ordinar
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac?
- Experiment social II – andimoisescu.ro
- Pentru posteritate
- In curand…
- “Hot” de id-uri messenger
- Chiar ca sunteti retardati
- Ce nu se invata la scoala – Vendetta (6)
Loading....
- Apocalipsa dupa Nemessis in (81 Visits)
- Ce servicii de mail folositi? in (28 Visits)
- This is the end in (23 Visits)
- Hackersblog.org is now blog.rstcenter.com in (17 Visits)
- Short news in (16 Visits)
- La multi ani România, la multi ani românilor in (15 Visits)
- Inca o pierdere de timp in (11 Visits)
- Azi este ziua userilor hackersblog.org in (10 Visits)
- Raportare vulnerabilitati in (9 Visits)
- Contact si vulns report in (7 Visits)
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac? in (229 Visits)
- Hi5.com coders read this in (28 Visits)
- SMS scam (1) in (21 Visits)
- Phishing Bancpost in (8 Visits)
- Dezinformare sau proasta informare? in (7 Visits)
- Si tentativele de phishing pot fi amuzante in (5 Visits)
- Phishing Raiffeisen cu atasament html in (4 Visits)
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta in (76 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (41 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (30 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (29 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (24 Visits)
- Virusi in clipuri video [how to] in (23 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (21 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (17 Visits)
- Yahoo! redirects - a big issue (with video) in (10 Visits)
- Ca musca in... in (9 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (123 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (72 Visits)
- Yahoo! epic fail - permanent xss unleashed in (71 Visits)
- Telegraph.co.uk hacked, sql injection in (52 Visits)
- RedTube.com ... The Free Sex Video Community in (42 Visits)
- Kaspersky Thailand hacked by TinKode in (37 Visits)
- Conquiztador Hacked Again in (33 Visits)
- Telegraph.co.uk hacked - when will they learn? in (29 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (27 Visits)
- In atentia BitDefender.com, SQL Injection in (26 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (24 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (20 Visits)
- Digital Photocopiers Loaded With Secrets in (15 Visits)
- Hacker Uses XSS and Google Street View Data to Determine Physical Location in (12 Visits)
- OWASP Phishing demo in (7 Visits)
- Oldies but goodies - Freedom Downtime - The Story of Kevin Mitnick in (7 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (6 Visits)
- Christopher "moot" Poole: The case for anonymity online in (6 Visits)
- Owasp5005 Part1 - New zero-day browser exploits - ClickJacking in (5 Visits)
- [Video] The History Of Hacking in (5 Visits)
- Se poate sparge parola de Yahoo? in (257 Visits)
- phpBB.ro hacked in (81 Visits)
- Cand dorinta de afirmare depaseste granitele bunului simt - PaxNwo un leecher ordinar in (47 Visits)
- Experiment social in (46 Visits)
- "Hot" de id-uri messenger in (39 Visits)
- Oare cum e pana la urma? in (39 Visits)
- Experiment social II - andimoisescu.ro in (37 Visits)
- Ce nu se invata la scoala – Vendetta (6) in (37 Visits)
- Concurs fara premii in (36 Visits)
- Forumul Andreei Balan spart in (33 Visits)
Posted on September 30th, 2009
POC: http://urlz.ro/bit
Later edit: same problem on bitdefender.es, bitdefender.fr and bitdefender.co.uk
September 30th, 2009 at 1:44 am
@ 2fingers,
Ai facut o mica eroare “gramaticala”, caci linga BitDefender.ro, intre paranteze trabuia sa mai indici si .it, .com, .de, .com.au, .es, .fr, .co.uk
September 30th, 2009 at 1:49 am
Sincer iti spun ca mi-a fost lene sa le iau pe toate la rand.
September 30th, 2009 at 2:04 am
@ 2fingers,
Pe mine m-a invins curiozitatea – chiar fiecare site foloseste aceleasi erori??
Si am descoperit ca numai pe BitDefender.SE se foloseste ceva diferit, in rest doar o banala traducere.
Si daca ar fi (nici nu ma indoiesc) un SQL injection? Sau poate toate site-urile folosesc aceeasi Baza de Date?
September 30th, 2009 at 2:15 am
Probabil e un copy/paste tradus pe domeniile respective. Nu absolut toate sunt la fel. Bitdefender.com.mx spre exemplu este diferit. Dar nu neaparat intr-un sens mai bun.
Daca cineva se apuca sa caute cu mare atentie in toate domeniile va gasi probabil mult mai multe vulnerabilitati si nu bag mana in foc ca vor fi doar cele de tip xss. Eu mi-am pierdut rabdarea sa caut cu mare atentie si am stat foarte putin timp ca sa gasesc xss-urile astea, dar pe com.mx, spre exemplu, am vazut niste erori sql care ma fac sa cred ca exista probleme si mai mari in acel domeniu.
Exemplu:
Query SQL:SELECT url,type,description,position FROM catalog.images WHERE id_domain = 'bitdefender.com.mx'AND id_item = '4768'' AND type='Image' ORDER BY position ASC
WARNING [/usr/local/idem/framework/lib/ensi/isql.class.php:80] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Image' ORDER BY position ASC' at line 3
September 30th, 2009 at 3:07 am
@ 2fingers,
Aha, asta am observat si eu.
Apropo, ceva nu e in regula cu forma de raportare a vulenrabilitatilor. Poti te rog sa te uiti sau sa ma contactezi? merci
September 30th, 2009 at 6:22 pm
Adica mai exact BitDefender au site-urile varza !