exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

European Security Services GPS 1.x SQL Injection / Bypass

European Security Services GPS 1.x SQL Injection / Bypass
Posted Sep 28, 2011
Authored by Benjamin Kunz Mejri, Vulnerability Laboratory | Site vulnerability-lab.com

European Security Services GPS version 1.x suffers from authentication bypass, input validation, and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 56f63da45d4480d8d879e32138f87536d879bd29d41aa7c40afb745b850b9244

European Security Services GPS 1.x SQL Injection / Bypass

Change Mirror Download
Title:
======
European Security Services GPS 1.x - Multiple Vulnerabilities


Date:
=====
2011-09-28



VL-ID:
=====
63


Reference:
==========
http://www.vulnerability-lab.com/get_content.php?id=63


Introduction:
=============
Für eine geringe Ortungsgebühr erhalten Sie einen Zugang zu unserem
Online Control Center. Nach erfolgreichem Login
stehen Ihnen Nachfolgende einstellungsmöglichkeiten und Daten zur
Verfügung. Dieses ermöglicht Ihnen z.B.:

- Punkt genaue Fahrstrecken Analyse
- Geschwindigkeitsangabe
- Tagesbericht
- Monatsbericht
- Geo-Fenster
- Real-Time Verfolgung
- Datensicherung 24 Monate
- 2D/3D Ansicht
- Ortung bis auf Hausnummer Ebene
- Adress Angabe
- Daten-Download (CSV)
- Adress-Suche

Dank der modernsten Technik sind wir heute im Stande mit diesen
Gegebenheiten auch für mehr Sicherheit zu sorgen.
Mit unserer Technik haben Sie die Möglichkeit z.B. Personen, Tiere,
Fahrzeuge, Container, Waren, Schiffe usw.
Weltweit bis auf 2 Meter genau zu orten. Zusätzlich stehen Ihnen noch
zahllose weitere Möglichkeiten zur Verfügung.
Sie können Beispielsweise Online in unserem H.E.S.S. Control Center
beobachten wie in Real time Ihr Kind morgens
zur Schule geht oder Ihre Ware in Japan vom Schiff geladen wird. Dem
Einsatzspektrum sind keine Grenzen gesetzt.
Einsatzbeispiele:


Für Privatkunden
Kinderortung - z.B. auf dem Nachhauseweg Abends vom Training im Verein
Senioren - z.B. für senile Ältere Personen die sich schnell Verlaufen
Sportler - z.B. für Bergwanderer, Skifahrer oder Extremsportler die
schnell in Gefahr kommen
Kfz Ortung / Diebstahlschutz - z.B. zur Kfz widerbeschaffung nach
einem Diebstahl
Tiere - z.B. für Weidetiere oder Pferde

Für Gewerbliche Kunden
Kfz Ortung / Diebstahlschutz - z.B. zur Fahrer- / Routenkontrolle
Ihrer Fahrzeuge
Baumaschinen - z.B. zur Absicherung Ihrer Baumaschinen auf Baustellen
Sicherheitsunternehmen - z.B. zur Observation / Detektivarbeiten
Speditionen - z.B. zur Überwachung der Lieferungen bzw. Transport
Überwachung
Alten- und Krankenpflege - z.B. zur Überwachung Ältere Personen die
sich schnell Verlaufen
Leasinggesellschaften - z.B. zur Kontrolle und Überwachung Ihrer
Leasing Produkte
Taxiunternehmen - z.B. zur Koordinierung in der Taxizentrale / zur
Sicherung der Fahrer
Fahrschulen - z.B. zur Fahrtroutenanalyse und zu Trainingszwecken
Behörden - z.B. zur Überwachung von Personen und Fahrzeugen

(Copy of the Vendor Homepage:
http://www.hess-security.de/das_control_center.html)


Abstract:
=========
The Vulnerability-Lab Team discovered multiple Web Vulnerabilities on
the gps tracking system of (EES) European Security Services.


Report-Timeline:
================
2011-03-02: Vendor Notification
2011-04-08: Vendor Response/Feedback
2011-**-**: Vendor Fix/Patch
2011-09-28: Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================
European Security Services GPS v1.0


Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
1.1
An Integer Overflow vulnerability is detected on the gps tracking system
of (EES) European Security Services.
The calender application module allows an attacker to crash the
applikation service via integer overflow bug.

Vulnerable Module(s):
[+] Calender

--- Exception Logs ---
System.Overflow:
Arithmetic operation resulted in an overflow.
at Microsoft.VisualBasic.CompilerServices.IntegerType.FromString(String
Value)
at findMe.showData.Page_Load(Object sender, EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)




1.2
Multiple persistent input validation vulnerabilities are detected on the
gps tracking system of (EES) European Security Services.
The vulnerability allows an local low privileged user account to
inject/implement malicious persistent script codes on application

side.
Successful exploitation of the vulnerability can result in session
hijacking or content request manipulation.

Vulnerable Module(s): (Persistent)
[+] Userdata Form allows
[+] Group Administration & Track ID
[+] User Password CSRF + Reset


1.2.1
Another vulnerability is located on the session handling of the gps
tracking system of (EES) European Security Services.
The passwords got transfered in plain via session cookie. Successful
exploitation can result in session hijacking without high
required user inter action.

Vulnerable Module(s):
[+] Session Handling


1.3
Attacker can bypass the auth of the login form. The vulnerability allows
remote attackers to access the
admin control panel without authorization.

Vulnerable Module(s):
[+] Login


Proof of Concept:
=================
1.1

Reference(s):

File(s): showdata.aspx
Param(s): ?name=noacct&month=8&year=
Param(s): ?name=noacct&month=


PoC:
Insert the following example string on the calender month parameter ...
-9999999999999999999999999999999


1.2

Note: To reproduce the persistent vulnerabilities inject/implement own
java or html script code on the affected vulnerable input

section.


1.2.1
URL=http://xxx.de/vemap.aspx?name=remove&gpasswd=mypasstest

<center>
<p><br><br>
<div id="LOGIN" >
<form action="" name="loginform">
<INPUT TYPE="TEXT" NAME="user" VALUE="remove" CLASS="LOGINFORM">
<INPUT TYPE="PASSWORD" NAME="passwort" Value="mypasstest" CLASS="LOGINFORM">
<INPUT TYPE="BUTTON" NAME="Login" VALUE="Login" CLASS="LOGINBUTTON"
ONCLICK="getPostData(document.loginform.user.value,document.loginform.passwort.value);"></form>



1.3
PoC:
Username: 'or 1=1--
Password: 'or 1=1--


Risk:
=====
1.1 The security risk of the client-side arithmetic integer
overflow web vulnerability is estimated as low.
1.2 The security risk of the multiple persistent web vulnerabilities
are estimated as medium(+).
1.2.1 The security risk of the unsecure session handling (plain
transfer) vulnerability is estimated as medium(+).
1.3 The security risk of the login (auth) bypass vulnerability is
estimated as critical.


Credits:
========
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve)


Disclaimer:
===========
The information provided in this advisory is provided as it is without
any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability
and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including
direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers
have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially
usages, of this file requires authorization from

Vulnerability-
Lab. Permission to electronically redistribute this alert in its
unmodified form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.

Copyright © 2011|Vulnerability-Lab

--
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
Contact: admin@vulnerability-lab.com or support@vulnerability-lab.com

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close