[NT] AdMentor Login Flaw (SQL Injection)
From: support@securiteam.comDate: 02/26/02
- Previous message: SecurITeam BugTraq Monitoring: "Re: elm bug ver 2.5.3 maybe others. (not suid on linux but suid on other OS.)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Tue, 26 Feb 2002 14:31:58 +0100 (CET)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
AdMentor Login Flaw (SQL Injection)
------------------------------------------------------------------------
SUMMARY
<http://www.aspcode.net/newaspcode/showquestion.php?faq=1&fldAuto=3>
AdMentor is a totally free ad rotator script written entirely in ASP. A
security vulnerability in the product allows remote attackers to cause the
login administration ASP to allow them to enter without knowing any
username or password (thus bypassing any authentication protection enabled
for the ASP file).
DETAILS
Vulnerable systems:
AdMentor version 2.11
AdMentor allows any user to login as administrator. The base path of the
login is usually:
http://www.example.com/admentor/admin/admin.asp
By using the following login:
' or ''='
And Password:
' or ''='
We can bypass the login verification, since the SQL query will look like:
SELECT row FROM table WHERE login = '' or ''=''
The same is true for the password.
Temporary solution:
Filter out the bad chars ' " ~ \ / by using the following piece of
JavaScript:
function RemoveBad(strTemp) {
strTemp = strTemp.replace(/\|\"|\'|\%|\;|\(|\)|\&|\+|\-/g,"");
return strTemp; }
And call it from within the ASP script:
var login = var TempStr = RemoveBad
(Request.QueryString("login"));
var password = var TempStr = RemoveBad
(Request.QueryString("password"));
ADDITIONAL INFORMATION
The information has been provided by <mailto:thran60@hotmail.com> Frank.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecurITeam BugTraq Monitoring: "Re: elm bug ver 2.5.3 maybe others. (not suid on linux but suid on other OS.)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
