Exploiting SQL Injection by Bypassing Client-Side Encryption
During a security assessment of a web application at http://aa.test.com:8088/Admin/Login, a SQL injection vulnerability was identified. The login request revealed that the username and password parameters were encrypted on the client side before transmission. Analysis of the page's JavaScript source...