[NT] XTREME ASP Photo Gallery SQL Injection (adminlogin.asp)
From: SecuriTeam (support_at_securiteam.com)
To: email@example.com Date: 19 Jan 2004 12:50:47 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
XTREME ASP Photo Gallery SQL Injection (adminlogin.asp)
<http://www.pensacolawebdesigns.com/> XTREME ASP Photo Gallery is "a
photo gallery that allows easy photo management and complete
administration via a web based interface. This interface offers many more
features than conventional web based photo gallery's do. With XTREME ASP
Photo Gallery, you can configure everything including colors, text styles,
amount of imaged displayed per page and much more".
Xtreme ASP Photo Gallery is prone to a common SQL injection vulnerability.
The problem occurs when handling user-supplied username and password data
supplied to authentication procedures.
* Xtreme ASP Photo Gallery Version 2.0
The vulnerable page adminlogin.asp is located by default in the following
If we type as the username: 'or' and as the password: 'or' we can gain
administrative access to the password protected administrative pages.
The following lines perform the authentication according to the user
MM_rsUser.Source = "SELECT username, password"
If MM_fldUserAuthorization < > "" Then MM_rsUser.Source = MM_rsUser.Source
& "," & MM_fldUserAuthorization
MM_rsUser.Source = MM_rsUser.Source & " FROM users WHERE username='" &
MM_valUsername &"' AND password='" & CStr(Request.Form("password")) & "'"
The code does not filter dangerous characters such as '. This allows a
malicious user to inject arbitrary SQL commands into the query.
Input from user should never be trusted. Always filter dangerous
characters. For additional information on SQL Injections see:
<http://www.securiteam.com/securityreviews/5DP0N1P76E.html> SQL Injection
The information has been provided by <mailto:firstname.lastname@example.org>
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.