I was scanning a site with Nessus when the following vulnerability was reported:
CGI Generic SQL Injection
Nessus says that:
"An attacker may exploit this flaw to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system."
So I continued reading and found out that the vulnerability sits in this piece of code:
Using the POST HTTP method, Nessus found that :
The following resources may be vulnerable to SQL injection :
The '_codeTextBox' parameter of the /LoginTeacherForm.aspx CGI :
/LoginTeacherForm.aspx [loginButton=Login&_VIEWSTATE=dDwtMTU2NDIxMDkwN Ts7Pg%3d%3d&btnChangePassword=Wijzig%20Pincode&_pinCodeTextBox=&_codeTex tBox='+convert(int,convert(varchar,0x7b5d))+']
-------- output --------
Exception Details: System.Data.SqlClient.SqlException: String or binary data would be truncated. The statement has been terminated.
But I'm wondering how an attacker could exploit this vulnerability, because when I paste that url it just gives me an error.
So my question is how would an attack be able to actually hack into the site and bypass login etc?