Full Disclosure mailing list archives
Re: iisPROTECT SQL injection in admin interface
From: "C. David Wilde" <cdw () mylinuxguy com>
Date: 23 May 2003 08:39:39 -0700
Don't you mean iIrony? On Fri, 2003-05-23 at 06:09, bugtraq () cgisecurity net wrote:
Between this and iDefense's advisory I think we could give this product the 'Irony of the year award'.Release Date: 23.05.2003 Application: iisPROTECT v/2.2-r4 (and probably earlier versions) Vendor: iisPROTECT #536, 425 Carrall St. Vancouver, BC, V6B6E3, Canada http://www.iisprotect.com/ Category: SQL injection in admin interface Risk: Medium-High Impact: Arbitrary command execution Vendor Status: First notified 15/04-2003 17:36 (+1) Fixed 15/04-2003 22:47 (+1) Author: Torben 'Gyrniff' Frohn email: nn () gyrniff dk Intro ====From vendor site: "iisPROTECT is a high performance user authentication,password protection and member system". iisPROTECT has a webbased admin interface, the interface lacks sanitising on almost every variable. Successfully exploited some of the variables can be used to inject and execute SQL statements. iisPROTECT uses either a MS access file or a MS SQL-server. In the testing environment the MS SQL-server solution is chosen. Exploit (Proof of Concept) =================== The following URL exploits the "GroupName" variable and uses the stored procedure "xp_cmdshell" to execute the command "ping": http://x.x.x.x/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20master..xp_cmdshell'ping%2010.10.10.11';-- Fix === Vendor has fixed this problem. Credits ===== Vulnerability found by Torben Frohn (Gyrniff) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- iisPROTECT SQL injection in admin interface Gyrniff (May 24)
- Re: iisPROTECT SQL injection in admin interface bugtraq (May 24)
- Re: iisPROTECT SQL injection in admin interface Shawn McMahon (May 24)
- Re: iisPROTECT SQL injection in admin interface C. David Wilde (May 24)
- Re: iisPROTECT SQL injection in admin interface bugtraq (May 24)