passprotect.txt

`****************************************************************************************************  
CRIOLABS   
  
- Software: Password protect   
- Type: User Authentication  
- Company: Web Animations  
- Date: 30-8-2004  
  
  
****************************************************************************************************  
  
  
## Software ##  
  
Software: Password protect   
Versions: All   
Languaje: ASP  
Plataforms: Win nt, 2000, xp   
Web: http://www.webanimations.com.au/  
  
  
The ultimate protection including unlimited user names and passwords each checking their individual  
ip address. You can add 1 ip address or include a range for the users with various IP address's   
when they log in.   
  
  
  
## Affected part ##   
  
- ChangePassword.asp (XSS in showmsg, SQL Injection in LoginId and OPass variables)  
- index.asp (XSS in showmsg)  
- index_next.asp (SQL Injection in admin and Pass variables)  
- users_list.asp (XSS in showmsg variable)  
- users_add.asp (XSS in showmsg variable, SQL Injection)  
- users_edit.asp (XSS, SQL Injection)  
  
  
  
## Vulnerabilities ##  
  
  
### SQL Injection ###  
  
A remote user can use an sql-injection attack to login as admin or manipulate the database.  
index_next.asp, ChangePassword.asp, users_edit.asp, users_add.asp are affected.  
  
  
Example:  
  
/adminSection/index_next.asp?  
admin = (SQLInjection) Pass = (SQLInjection)   
  
/adminSection/ChangePassword.asp?  
LoginId=(SQLInjection) OPass=(SQLInjection) NPass=(SQLInjection) CPass=(SQLInjection)  
  
  
Proof of Concept:  
  
Login Id:'or''='  
Password:'or''='  
  
Login Id: admin  
Password:'or''='  
  
  
  
### Cross-site Scripting ###  
  
This software do not filter HTML code from user-supplied input in some scripts.  
  
  
Example:  
  
/adminSection/index.asp?ShowMsg=(XSS)  
/adminSection/ChangePassword.asp?ShowMsg=(XSS)  
/adminSection/users_list.asp?showmsg=(XSS)  
/adminSection/users_add.asp?showmsg=(XSS)   
  
  
  
  
## History ##  
  
Vendor contacted: Fri, 06 Aug 2004, no response.   
  
  
  
## Credits ##  
  
Criolabs staff  
http://www.criolabs.net   
`