Re: [Full-Disclosure] iisPROTECT SQL injection in admin interface
To: email@example.com (Gyrniff) Date: Fri, 23 May 2003 09:09:35 -0400 (EDT)
Between this and iDefense's advisory I think we could give this product the
'Irony of the year award'.
> Release Date: 23.05.2003
> Application: iisPROTECT v/2.2-r4 (and probably earlier versions)
> Vendor: iisPROTECT
> #536, 425 Carrall St.
> Vancouver, BC,
> V6B6E3, Canada
> Category: SQL injection in admin interface
> Risk: Medium-High
> Impact: Arbitrary command execution
> Vendor Status: First notified 15/04-2003 17:36 (+1)
> Fixed 15/04-2003 22:47 (+1)
> Author: Torben 'Gyrniff' Frohn
> email: firstname.lastname@example.org
> >From vendor site: "iisPROTECT is a high performance user authentication,
> password protection and member system".
> iisPROTECT has a webbased admin interface, the interface lacks sanitising on
> almost every variable. Successfully exploited some of the variables can be
> used to inject and execute SQL statements.
> iisPROTECT uses either a MS access file or a MS SQL-server. In the testing
> environment the MS SQL-server solution is chosen.
> Exploit (Proof of Concept)
> The following URL exploits the "GroupName" variable and uses the stored
> procedure "xp_cmdshell" to execute the command "ping":
> Vendor has fixed this problem.
> Vulnerability found by Torben Frohn (Gyrniff)
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
Full-Disclosure - We believe in it.