<html><body bgcolor="#FFFFFF">
<p><font size="2" face="sans-serif">Hi Jules,</font><br>
<br>
<font size="2" face="sans-serif">i will verify all ways (without account / with account) and will let you know more detailed information...</font><br>
<br>
<font size="2" face="sans-serif">Mit freundlichen Grüßen / Best regards<br>
<br>
Patrick Gaikowski<br>
Tel: +49 7132 94 3568<br>
Fax: +49 7132 94 73568<br>
E-Mail: patrick.gaikowski@kaufland.com<br>
KI 967800 IT International / Infrastruktur<br>
Office:<br>
Lindichstrasse 11<br>
D-74189 Weinsberg</font><br>
<br>
<br>
<br>
<font size="2" face="sans-serif"><a href="http://www.kaufland.de">http://www.kaufland.de</a> </font><br>
<font size="2" face="sans-serif">Wir sind die Nr. 1:</font><br>
<font size="2" face="sans-serif">Kaufland ist "Bester Lebensmittelmarkt 2011"!</font><br>
<br>
<font size="2" face="sans-serif">Kaufland Informationssysteme GmbH & Co. KG</font><br>
<font size="2" face="sans-serif">Postfach 12 53 - 74149 Neckarsulm<br>
Kommanditgesellschaft<br>
Sitz: Neckarsulm<br>
Registergericht: Amtsgericht Stuttgart HRA 104163</font><br>
<ul style="padding-left: 18pt"><img width="16" height="16" src="cid:1__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt="Inactive hide details for Jules <Jules@zend.to>"><font size="2" face="sans-serif">Jules <Jules@zend.to></font></ul>
<br>
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="40%">
<ul style="padding-left: 9pt"><font size="1" face="sans-serif"><b>Jules <Jules@zend.to></b></font><font size="1" face="sans-serif"> </font><br>
<font size="1" face="sans-serif">Gesendet von: zendto-bounces@zend.to</font>
<p><font size="1" face="sans-serif">17.05.2011 10:43</font>
<table border="1">
<tr valign="top"><td width="168" bgcolor="#FFFFFF">
<ul style="padding-left: 0pt"><font size="1" face="sans-serif">Bitte antworten an<br>
ZendTo Users <zendto@zend.to></font></ul>
</td></tr>
</table>
</ul>
</td><td width="60%">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="1%" valign="middle"><img width="66" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""><br>
</td><td width="100%"><img width="1" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""><br>
<font size="1" face="sans-serif">ZendTo Users <zendto@zend.to></font></td></tr>
<tr valign="top"><td width="1%" valign="middle"><img width="66" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""><br>
</td><td width="100%"><img width="1" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""><br>
</td></tr>
<tr valign="top"><td width="1%" valign="middle"><img width="66" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""><br>
<div align="right"><font size="1" face="sans-serif">Thema </font></div></td><td width="100%"><img width="1" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""><br>
<font size="1" face="sans-serif">[ZendTo] Re: Zendto is vulnerable for SQL-Injection</font></td></tr>
</table>
<table border="0" cellspacing="0" cellpadding="0">
<tr valign="top"><td width="58"><img width="1" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""></td><td width="336"><img width="1" height="1" src="cid:2__=4EBBF200DFA3F8568f9e8a93@de.int.kaufland" border="0" alt=""></td></tr>
</table>
</td></tr>
</table>
<br>
<font size="3" face="serif">Very good, but exactly what was the process you or it used to achieve this?<br>
I thought I had spotted all the points where this was possible, but obviously missed one!<br>
<br>
Without more details, there's little I can do about it. Which is obviously not what we both want.<br>
<br>
So please send me some more useful information.<br>
<br>
Many thanks,<br>
Jules.<br>
<br>
On 17/05/2011 08:59, </font><a href="mailto:patrick.gaikowski@kaufland.com"><font size="3" color="#0000FF" face="serif"><u>patrick.gaikowski@kaufland.com</u></font></a><font size="3" face="serif"> wrote: </font>
<ul style="padding-left: 36pt"><br>
<font size="2" face="sans-serif">Hi @ all,</font><font size="3" face="serif"><br>
</font><font size="2" face="sans-serif"><br>
i tried to audit zendto with parosproxy (</font><a href="http://www.parosproxy.org/"><font size="2" color="#0000FF" face="sans-serif"><u>www.parosproxy.org</u></font></a><font size="2" face="sans-serif">) and found out that zendto is vulnerable for SQL-injection. The proxy manipulates the claimid and claimpasscode and could blow up the database with dropoffs! </font><font size="3" face="serif"><br>
</font></ul>
<br>
<br>
<tt><font size="3">-- <br>
Julian Field MEng CITP CEng<br>
</font></tt><a href="http://www.zend.to/"><tt><font size="3" color="#0000FF"><u>www.Zend.To</u></font></tt></a><tt><font size="3"><br>
<br>
Follow me at twitter.com/JulesFM<br>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br>
<br>
'All programs have a desire to be useful' - Tron, 1982<br>
</font></tt><tt><font size="2">_______________________________________________<br>
ZendTo mailing list<br>
ZendTo@zend.to<br>
</font></tt><tt><font size="2"><a href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></font></tt><br>
</body></html>