eSyndiCat - Multiple SQL Injection's

Discussion in 'Directories' started by SEOdir.net, Jul 16, 2007.

Thread Status:
Not open for further replies.
0
  1. #1
    Hello,
    there is a exploit that can easy steal admin md5 coded password.
    I tested it on some directories and most of them are susceptible to this exploit.

    Just to inform you guys.

    This exploit has been released in public on 14 July.

    Please do not PM me about the url of exploit or other info, just check http://www.esyndicat.com and download the newest version or ask for support.
     
    SEOdir.net, Jul 16, 2007 IP
    jetbrains and The Pheonix like this.
  2. britishguy

    britishguy Prominent Member

    Messages:
    7,949
    Likes Received:
    892
    Best Answers:
    0
    Trophy Points:
    360
    #2
    Good information for all the script users
    Thanks for posting :)
     
    britishguy, Jul 16, 2007 IP
    jetbrains likes this.
  3. an0n

    an0n Prominent Member

    Messages:
    5,688
    Likes Received:
    915
    Best Answers:
    0
    Trophy Points:
    360
    #3
    Just do your best to work with esyndicat to help them resolve the issue. :)
     
    an0n, Jul 16, 2007 IP
  4. YMC

    YMC Well-Known Member

    Messages:
    2,787
    Likes Received:
    404
    Best Answers:
    4
    Trophy Points:
    190
    #4
    Which version(s) are involved?
     
    YMC, Jul 16, 2007 IP
  5. SergeF

    SergeF Peon

    Messages:
    294
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #5
    The exploit has been fixed.
     
    SergeF, Jul 16, 2007 IP
    jetbrains likes this.
  6. wildweb

    wildweb Peon

    Messages:
    143
    Likes Received:
    46
    Best Answers:
    0
    Trophy Points:
    0
    #6
    so what version(s) were/are affected?
     
    wildweb, Jul 16, 2007 IP
    jetbrains likes this.
  7. jetbrains

    jetbrains Well-Known Member

    Messages:
    1,747
    Likes Received:
    137
    Best Answers:
    0
    Trophy Points:
    133
    #7
    Thanks for your info .
    I got a replay from support
    This problem has been fixed long ago Thanks for that
     
    jetbrains, Jul 16, 2007 IP
  8. SergeF

    SergeF Peon

    Messages:
    294
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #8
    the exploits exist in 1.2 and 2.0
    2.1 version has all these exploits fixed.

    We have asked all our customers to upgrade their versions to the latest one. Also an informative newsletter has been dispatched to all our subscribers.
     
    SergeF, Jul 16, 2007 IP
    LeopardAt1 likes this.
  9. YMC

    YMC Well-Known Member

    Messages:
    2,787
    Likes Received:
    404
    Best Answers:
    4
    Trophy Points:
    190
    #9
    Ahh, so this is the exploit I fell victim to back in February. Informative newsletter? When was that sent?
     
    YMC, Jul 17, 2007 IP
  10. wildweb

    wildweb Peon

    Messages:
    143
    Likes Received:
    46
    Best Answers:
    0
    Trophy Points:
    0
    #10
    An upgrade should ONLY be an option. You "SHOULD" provide a patch. As I and many many others have tried the upgrade from 1.x to 2.x...it's a mess and rarely works. Your support forum is full of unanswered pleas for help to get upgraded. The only time I see an answer to this upgrade problem, is when I see the answer..pay $35 for ES to upgrade it for you. I "did" own a pro version of 1.x and after four attempts at the upgrade, I simply through the script out and replaced it with another one. Such a waste as your 2.x has many enhancements and ES is a great script. Sad to see that your support of a security vulnerability patch and the whole upgrade scenario is lacking.

    SO.. I say again...a "patch" should be made available for the affected versions.

    I'm sure I'm not the only one that feels this way.

    tom
     
    wildweb, Jul 17, 2007 IP
  11. an0n

    an0n Prominent Member

    Messages:
    5,688
    Likes Received:
    915
    Best Answers:
    0
    Trophy Points:
    360
    #11
    hahaha sounds like another script :) sad sad sad
     
    an0n, Jul 17, 2007 IP
  12. SergeF

    SergeF Peon

    Messages:
    294
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    0
    #12
    Simon Gooffin says
     
    SergeF, Jul 17, 2007 IP
  13. The Pheonix

    The Pheonix Banned

    Messages:
    1,233
    Likes Received:
    96
    Best Answers:
    0
    Trophy Points:
    0
    #13
    Isnt it a case of moving on and F the rest?

    A very worrying development indeed. I feel sorry for all those who have the old version.

    Kudos to the OP for posting this warning.
     
    The Pheonix, Jul 18, 2007 IP
Thread Status:
Not open for further replies.