Easy prey carder [1], or Access database system Q-Shop
LwB Security Team
= = -------------------------------------------
-written durito
-e-mail: [email protected]
-http: //www.lwbteam.org
-date: 21/01/2004
-Comments: Information is provided only
for review and considered,
as a guide for administrators,
This article is not
guide to action.
We are not responsible for
damage committed readers
of this article, and illegal
use provided
contact information
= = -------------------------------------------
- = Easy prey carder [1], or Access database system Q-Shop = -
In this article I will describe the use of the vulnerability in the system Q-Shop
for example, the access to the database qshop.chexsite.com
A feature of this e-commerce system is that when
availability stupid admin store database is accessible to anyone
remote user. Using the following
URL that the villain can gain access to the database:
http: // [target] /db/store.mdb
Now for those who do not understand.
link will go on:
http://qshop.chexsite.com/db/store.mdb
Downloading base, it zaparoleny respectively.
Therefore, we need the files of Cain with http://www.oxid.it/
It has very good access decoder, who will show us the password to the database.
In this case, the password: qs1898
Putting it and you are in the database, only one problem in this database does not offer ss.
But there are other Q-Shop.
Copyright 2002-2004 by LwB Security Team. All rights reserved.
