[NT] DUPortal Pro SQL Injection

From: SecuriTeam (support_at_securiteam.com)
Date: 04/21/05

  • Next message: SecuriTeam: "[EXPL] ICMP Attacks Against TCP Vulnerability Exploit" 
    To: list@securiteam.com
Date: 21 Apr 2005 15:20:58 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      DUPortal Pro SQL Injection
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.duware.com/> DUdirectory Pro is a professional Web Links
    Directory and Rating system. Backed-end by MS SQL Server database and
    organized in an unlimited number of nested categories and sub categories,
    DUdirectory Pro can store unlimited number of links."

    Flaws in user input validation makes DUPortal Pro vulnerable to SQL
    Injection attacks.

    DETAILS

    Vulnerable Systems:
     * DUPortal Pro version 3.4 and prior.

    Multiple SQL injection vulnerabilities have been discovered in cat.asp,
    default.asp and detail.asp files. The following URLs will list all the
    possible SQL injection vectors:
    http:/[host]/[path]/cat.asp?iChannel='SQL_INJECTION'
    http:/[host]/[path]/cat.asp?nChannel='SQL_INJECTION'
    http:/[host]/[path]/default.asp?iCat='SQL_INJECTION'
    http:/[host]/[path]/default.asp?iChannel='SQL_INJECTION'
    http:/[host]/[path]/default.asp?nChannel='SQL_INJECTION'
    http:/[host]/[path]/detail.asp?iData='SQL_INJECTION'
    http:/[host]/[path]/detail.asp?iCat='SQL_INJECTION'
    http:/[host]/[path]/detail.asp?iChannel='SQL_INJECTION'
    http:/[host]/[path]/detail.asp?nChannel='SQL_INJECTION'

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:dcrab@hackerscenter.com>
    DCrab.
    The original article can be found at: <http://www.digitalparadox.org>
    http://www.digitalparadox.org

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] ICMP Attacks Against TCP Vulnerability Exploit"

    Relevant Pages

    • [UNIX] Protector System Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Several classes of vulnerabilities have been found in Protector. ... cross-site scripting and SQL injection attacks. ...
      (Securiteam)
    • [UNIX] PhotoPost PHP Pro Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PhotoPost PHP Pro suffers from multiple SQL injection, ... There are plenty of SQL injection vulnerabilities in PhotoPost PHP Pro. ...
      (Securiteam)
    • [REVS] Advanced Topics on SQL Injection Protection
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SQL injection is now one of the most common attacks in the Internet. ... Static query statement - Development Phrase ... Some programmers may think escaping apostrophe with two apostrophes (and ...
      (Securiteam)
    • [TOOL] BSQL Hacker - Advanced SQL Injection Framework / Tool
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... BSQL Hacker - Advanced SQL Injection Framework / Tool ... Attack Templates: ... Blind SQL Injection ...
      (Securiteam)
    • [UNIX] PHPNuke Multiple Vulnerabilities in Search Module
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... cross-site scripting and SQL injections located throughout the ... The vulnerability exists in the ... The first SQL injection vulnerability is a non-critical one in the ...
      (Securiteam)