<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Very good, but exactly what was the process you or it used to
achieve this?<br>
I thought I had spotted all the points where this was possible, but
obviously missed one!<br>
<br>
Without more details, there's little I can do about it. Which is
obviously not what we both want.<br>
<br>
So please send me some more useful information.<br>
<br>
Many thanks,<br>
Jules.<br>
<br>
On 17/05/2011 08:59, <a class="moz-txt-link-abbreviated" href="mailto:patrick.gaikowski@kaufland.com">patrick.gaikowski@kaufland.com</a> wrote:
<blockquote
cite="mid:OFC5EE4BC7.A0B57EFC-ONC1257893.002B7D48-C1257893.002BF1D5@de.int.kaufland"
type="cite">
<p><font face="sans-serif" size="2">Hi @ all,</font><br>
<br>
<font face="sans-serif" size="2">i tried to audit zendto with
parosproxy (<a class="moz-txt-link-abbreviated" href="http://www.parosproxy.org">www.parosproxy.org</a>) and found out that zendto is
vulnerable for SQL-injection. The proxy manipulates the
claimid and claimpasscode and could blow up the database with
dropoffs! </font><br>
<br>
</p>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Julian Field MEng CITP CEng
<a class="moz-txt-link-abbreviated" href="http://www.Zend.To">www.Zend.To</a>
Follow me at twitter.com/JulesFM
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
'All programs have a desire to be useful' - Tron, 1982
</pre>
</body>
</html>