aenovoSQL.txt

🗓️ 08 Oct 2005 00:00:00Reported by DevilBoxType
packetstorm🔗 packetstormsecurity.com👁 30 Views
Aenovo Multiple Vulnerabilities with SQL Injection, Weak Password Storage and XS
`Aenovo Multiple Vulnerabilities  
  
[KAPDA::#3] - Aenovo - Multiple Vulnerabilities  
  
KAPDA New advisory  
  
Vulnerable products : Aenovo(v Trial`s tested,Hopefully all other versions),  
  
AenovoShop and aeNovoWYSI (v Demo`s tested,Hopefully all other versions)   
  
Vendor: http://www.aenovo.co.uk/  
  
Risk: High  
  
Vulnerability: Sql injection-Weak password storage-Cross site Scripting (xss)  
  
About Aenovo  
--------------------  
aeNovo is a collection of sophisticated web pages   
  
that allows you to have a website that's as big and  
  
as elaborate as you make it. Once your aeNovo   
  
files are moved to your web space you can add, delete  
  
and amend pages, images and all manner of files  
  
all THROUGH THE BROWSER.  
  
Vendor`s description : http://www.aenovo.co.uk/introduction.asp  
  
Discussion :  
----------------  
Several scripts do not properly validate user-supplied  
  
input. A remote user can create specially crafted  
  
parameter values that will execute SQL commands on the  
  
underlying database.Also it is possible to Inject Html scripts  
  
in vulnerable page.  
  
One the most Important rules in Application security is   
  
confidentiality of stored passwords.To achive this goal   
  
Applications ( Including web apps) encrypt passwords and  
  
store crypted hashes.This application suffer from Clear Text  
  
Password Storage.  
  
As we know and tested all versions of Aenovo , Aenovoshop   
  
and aeNovoWYSI are vulnerable.  
  
  
Vulnerabilities:  
--------------------  
  
[1] Sql injection in /password/default.asp (/user/control.asp)   
  
at parameter named 'password'.Attacker can enter Sql to login  
  
to system as low-level user.  
  
[2]Clear Password Storage at 'control','content' and 'pages' tables.  
  
[3]Sql injection in /search.asp (/incs/searchdisplay.asp)  
  
at parameter named 'strSQL'.  
  
[4]Xss can be found in most of active server pages   
  
which get and render user-supplied input.  
  
Proof of Concepts:  
--------------------  
  
[1]  
<html>  
<h1>Aenovo Login-Bypass PoC - Kapda `s advisory </h1>  
<p> Discovery and exploit by farhadkey [at} kapda.ir</p>  
<p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute   
of Iran</a></p>  
<form method="POST" action="http://target/user/control.asp">  
<input type="hidden" name="password" value="[SQL Injection]" >  
<input type="submit" value="Submit" name="B1">  
<input type="hidden" name="test" value="1">  
</form></html>  
  
[3]   
AeNovo :Lists username and password of administrators  
http://target/search.asp?strSQL=[SQL Injection]  
  
AeNovoShop:Lists username and password of administrators  
http://target/search.asp?strSQL=[SQL Injection]  
  
  
AeNovoWYSI:Lists username and password of administrators  
http://target/search.asp?strSQL=[SQL Injection]  
  
Solution:  
--------------------  
No patch`s released yet by vendor.  
This advisory is reported to Vendor about one month ago.  
  
More Detail:  
--------------------  
http://www.kapda.ir/advisory-78.html  
Visit above link for more details.  
  
Credit :  
--------------------  
Farhad Koosha & Devil_box   
devil_box [at} kapda.ir  
farhadkey [at} kapda.ir  
Kapda - Security Science Researchers Insitute of Iran  
http://www.KAPDA.ir  
(PersianHacker.NET)  
`
08 Oct 2005 00:00Current
7.4High risk
Vulners AI Score7.4