[NT] SiteEnable XSS and SQL injection
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 5 Apr 2005 08:18:28 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
SiteEnable XSS and SQL injection
<http://www.siteenable.com/default.asp> SiteEnable is "a simple content
management, combined with powerful functionality". Two types security
vulnerabilities have been found in the SiteEnable, one allows injecting
arbitrary SQL statements.
Cross Site Scripting:
Due to poor filtering of the 'contenttype' variable a remote user can
Another more severe script injection is in the Submit a Quote page in
which neither title or description fields are filtered. This can affect
all the visitors of the site. Anyone can inject a silent script and grab
anyone's password or cookie.
The 'sortby' parameter is directly passed to the SQL string without any
checks. The following URL can be used to determine whether you are
vulnerable or not:
http://site/content.asp?do_search=0&keywords=contact&page_no=2&sortby=;SELECT%20* FROM bla bla--
The information has been provided by <mailto:email@example.com>
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.