bugtraq - ASP Product catalog SQL injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070930022514.27972.qmail@securityfocus.com>
Date: 30 Sep 2007 02:25:14 -0000
From: joseph.giron13@...il.com
To: bugtraq@...urityfocus.com
Subject: ASP Product catalog SQL injection vulnerability

ASP Product catalog SQL injection vulnerability.

A nice little SQL injection vulnerability exists within ASP Product Catalog. The application fails to check for bad input from GET'd variables used in SQL query operations. In this case, the variable [cid] can be used for SQL injection queries. Example:

http://www.example.com/Catalog/catalog.asp?cid=8%20union%20all%20select%20Password,User_ID,Password,User_ID,Password,User_ID,Password%20from%20admin#

For those unfamiliar with how I got the table names and fields, it was retireved from the mdb file included with Asp Product catalog. A few oder by's reveals 9 columns...And we grab our username and password from the list. Now, we can login to our catalog and have fun.

http://www.example.com/catalog/login.asp

Stay secure.