NSFocus video Conferencing System SQL injection

By injecting access to the Admin account password and then logging in to the background to view the meeting password, a malicious attacker can steal sensitive information through a meeting password that can be entered into a remote meeting.

Http://211.151.49.196:18080/V2Conf/jsp/user/loginAction.do

In fact, the V2 conference video conferencing system, a lower version of SQL injection, which occurs in the input box for the user name at logon, can be tested using the following injection statement:

1 ' or (select Benchmark (300000,md5 (user)) from users where substring (username,1,5) = ' admin ') #

Repair scheme:

Upgrade Patches