Security Concerns with MSSQL Manager

[jaymac]

Hey Guys,

I was a little concerned today when I logged into the MSSQL manager today for the first time on my website. When I logged on by clicking on the magnifying glass next to MSSQL manager in my control panel, I noticed that my username and password were embedded right into the front of the URL! Thats pretty poor security! On a shared computer this URL is saved in the history, along with my password for any one to see. Also, since the log in didnt seem to work, I modified the url slightly and went to this page:

www.arguecity.com/MSSQL/app/connect.aspx

You will notice that when you go there, the password box is actually just a plain text box!

Im not sure who's responsibility it is to fix this, but wow!

Jason

[admin]

Originally Posted by jaymac

Hey Guys,

I was a little concerned today when I logged into the MSSQL manager today for the first time on my website. When I logged on by clicking on the magnifying glass next to MSSQL manager in my control panel, I noticed that my username and password were embedded right into the front of the URL! Thats pretty poor security! On a shared computer this URL is saved in the history, along with my password for any one to see. Also, since the log in didnt seem to work, I modified the url slightly and went to this page:

www.arguecity.com/MSSQL/app/connect.aspx

You will notice that when you go there, the password box is actually just a plain text box!

Im not sure who's responsibility it is to fix this, but wow!

Jason

This is really used widely by many CP's and other software. Now does not even work as it use to because of MS making some changes to IE. H-Sphere should be changing WebShell, aspx EM, and someother stuff will change to login anther way but it may stills how the username and password, there is not many ways to pass this info to anther server with out using something in the URL.

[jaymac]

How about not passing it at all? Have the magnifying glass go to a regular, secure, login page?

[Brangwyn]

Might want to post suggestions at psofts forum www.psoft.net we're pretty much stuck with whatever they decide to churn out