full-disclosure - Craft Silicon Banking@...e SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6886de5a0902101154i5264cd28wf3b59e016eccc0ac@mail.gmail.com>
Date: Tue, 10 Feb 2009 20:54:56 +0100
From: Francesco Bianchino <f.bianchino@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Craft Silicon Banking@...e SQL Injection

Craft Silicon Banking@...e SQL Injection

***********************************************************************

Author: Francesco Bianchino

Email: f.bianchino [at] gmail.com

Title: Craft Silicon Banking@...e SQL Injection

Product: Banking@...e - Net Banking

Versions Vulnerable: 2.1 and below

Vendor: Craft Silicon (www.craftsilicon.com)

***********************************************************************

Summary

Banking@...e is an home banking application that allows customers to access
their account information using the web.
The application uses data in a database management system that uses Structured
Query Language (SQL) as a data access standard.

**********************************************************************

Vulnerability Details

The login page of Net Banking is vulnerable to SQL Injection attack,
due to a missing input validation mechanisms.
An attacker can inject SQL code into the username and password fields,
altering the login procedure.
There is a classic error based injection, really easy to exploit to
take control
of the entire server.
Authentication bypass is possible using valid username, no password is
required,
or otherwise the user table can be arbitrary modified.

***********************************************************************

Exploit

http://www.example.com/document_root/Login.asp?LoginName='Some_SQL_Stuff&Password=&submit=Login

***********************************************************************

Solution

At the moment of writing this advisory there is no solution yet.
I advised Craft Silicon in November 2008 and i actually have received no answer.

***********************************************************************

Credits

Discovered by Francesco Bianchino.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/