phishing attempt via Four Courts Press

expectationlost

it seems that http://fourcourtspress.ie account information (email address) may have been compromised got a fake fill out a survey and your credit card details email and then an email from four courts press itself warning of phishing attempt.

dudara

Moved to Security

dudara

900913

It looks like they have been vulnerable for over a year now.

Here's a google cached page from a Russian site posted on 15.04.2010
http://webcache.googleusercontent.com/search?q=cache:mjWJwbtC2-EJ:https://forum.antichat.ru/printthread.php%3Ft%3D21336%26page%3D1188%26pp%3D10+intext:fourcourtspress.ie+sql&cd=1&hl=de&ct=clnk&gl=de&client=firefox-a&source=www.google.de

It shows details of the sql injection attack.


They still appear to be vulnerable http://webcache.googleusercontent.com/search?q=cache:Rh-eJhbiq2gJ:www.fourcourtspress.ie/product.php%3FintProductID%3D738%2BAnD%2B1%3D2%2BUnIoN%2BSeLeCt%2B1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--+site:fourcourtspress.ie+%22union%2Bselect%22&cd=1&hl=de&ct=clnk&gl=de&client=firefox-a&source=www.google.de

BaconZombie

Going by the Four Courts mail public calender is a direct link to a Lotus Notes {old version} .NSF file , I'm not surprised.

900913

Every php script on fourcourtspress is vulnerable to sql injection.

Going by this it's vulnerable for over a year http://webcache.googleusercontent.com/search?q=cache:mjWJwbtC2-EJ:https://forum.antichat.ru/printthread.php%3Ft%3D21336%26page%3D1188%26pp%3D10+intext:fourcourtspress.ie+sql&cd=1&hl=de&ct=clnk&gl=de&client=firefox-a&source=www.google.de

The sql injection might not affect their users but with every sqli theres an xss.