Security Advisories | SQL Injection | MSN SQL Injection Vulnerability
Vendor: MSN
Web Site Affected: http://server1.msn.co.in/wallpaper/userchoose.asp
Type: SQL Injection
Severity: Critical
Date released: 29th December 2005

A SQL Injection Vulnerability has been reported in the MSN India Web site. The Vulnerability allows an attacker to run arbitrary query on the MSN SQL server. It also reveals some crucial information regarding the database which includes Server name, Database name, and Table name, etc.

The screenshots can be viewed here

The vulnerability allows an attacker to run an arbitrary query on the SQL server

Vendor has been notified.

Microsoft responded immediately, and removed the vulnerable pages from the MSN website.