EXCELLENT INFOTEK BiYan Pre-Auth SQL Injection
EXCELLENT INFOTEK BiYan v2.9~v3.0 has a SQL injection vulnerability, allowing execution of arbitrary SQL commands via <LOGIN_ID> parameter without authentication. The SQL commands can be executed for any user accessing the page. This vulnerability affects many systems of government and company.
The injection point is <LOGIN_ID> parameter in "query_user_data.aspx".
It allows remote attackers to execute arbitrary SQL commands via <LOGIN_ID> paramemer without authentication.
Remote attackers can gain unauthorized data like user's account and password. When accessing a victim's account, remote attackers can modify the password. It compromised the confidentiality, integrity and availability of data and system.
Remote attackers can execute arbitrary SQL commands without authentication.
- Tony Kuo (CHT Security)