Vulnwatch mailing list archives
Snitz Forum 3.3.03 Remote Command Execution
From: <sharpiemarker () hushmail com>
Date: Mon, 12 May 2003 08:47:38 -0700
[Moderator: This was inadvertently sent to "VulnDiscuss" instead of "VulnWatch" over the weekend.] Overview: Snitz Forums 2000, one of the best ASP based bulletin board systems on the market. Getting better every day! A complete board system (forum) that allows the user access to a friendly and intuitive interface. http://forum.snitz.com Problem Description: Snitz Forums 3.3.03 has an SQL injection vulnerability in its "register.asp" page with its "Email" variable. Because "register.asp" doesn't check user input, remote users can execute stored procedures (such as "xp_cmdshell") to arbitrarily run non-interactive commands on the system. Vendor Notification: Vendor notified last month. This is a deprecated version and users should upgrade immediately. Versions Affected: 3.3.03 Most likely earlier versions (not tested) Fix: Upgrade to 3.4.03, the latest version. Exploit: See attached proof-of-concept Perl exploit.
Attachment:
snitz_exec.pl
Description:
Current thread:
- Snitz Forum 3.3.03 Remote Command Execution sharpiemarker (May 12)