ASP Product catalog SQL injection vulnerability

2007.10.05
Credit: joseph
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

ASP Product catalog SQL injection vulnerability. A nice little SQL injection vulnerability exists within ASP Product Catalog. The application fails to check for bad input from GET'd variables used in SQL query operations. In this case, the variable [cid] can be used for SQL injection queries. Example: http://www.example.com/Catalog/catalog.asp?cid=8%20union%20all%20select% 20Password,User_ID,Password,User_ID,Password,User_ID,Password%20from%20a dmin# For those unfamiliar with how I got the table names and fields, it was retireved from the mdb file included with Asp Product catalog. A few oder by's reveals 9 columns...And we grab our username and password from the list. Now, we can login to our catalog and have fun. http://www.example.com/catalog/login.asp Stay secure.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top