Project

Profile

Help

HostedRedmine.com has moved to the Planio platform. All logins and passwords remained the same. All users will be able to login and use Redmine just as before. Read more...

Bug #279002

Fatal error

Added by Gen Va over 8 years ago.

Status:
New
Priority:
Immediate
Assignee:
-
Start date:
2014-03-12
Due date:
% Done:

0%

Estimated time:

Description

There is the opportunity to do a sql injection, to see pieces of code, and the opportunity to see the passwords that should be hached.
A user should only see an error page as a maximum.

Steps to reproduce:

1. Go to http://registratium.mobidev.biz/index.php/regaster;
2. Fill out all fields correctly except of the "Surname" field;
3. Fill out "Surname" field by entering *"* (quotes);
4. Press "Submit" button;
Please see 'error.jpg' attached file

error.jpg (141 KB) error.jpg Gen Va, 2014-03-12 02:02 AM
250

Also available in: Atom PDF