From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 5 Apr 2005 08:18:28 +0200
Subject: [NT] SiteEnable XSS and SQL injection
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050405112059.D9B055818@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SiteEnable XSS and SQL injection
------------------------------------------------------------------------
SUMMARY
<http://www.siteenable.com/default.asp>; SiteEnable is "a simple content
management, combined with powerful functionality". Two types security
vulnerabilities have been found in the SiteEnable, one allows injecting
arbitrary HTML and/or JavaScript, while the other allows injecting
arbitrary SQL statements.
DETAILS
Cross Site Scripting:
Due to poor filtering of the 'contenttype' variable a remote user can
inject arbitrary HTML and/or JavaScript into the content returned to the
user:
http://site/content.asp?contenttype=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Another more severe script injection is in the Submit a Quote page in
which neither title or description fields are filtered. This can affect
all the visitors of the site. Anyone can inject a silent script and grab
anyone's password or cookie.
SQL Injection:
The 'sortby' parameter is directly passed to the SQL string without any
checks. The following URL can be used to determine whether you are
vulnerable or not:
http://site/content.asp?do_search=0&keywords=contact&page_no=2&sortby=;SELECT%20* FROM bla bla--
ADDITIONAL INFORMATION
The information has been provided by <mailto:zinho@hackerscenter.com.>
Zinho.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
