[KAPDA::#47] - Snitz Forum <= 3.4.05 SQL-Injection Vulnerability KAPDA New advisory Advisory Number: 47 Vulnerable products : Snitz Forum <= 3.4.05 Vendor: http://forum.snitz.com Vulnerability: SQL_Injection Date : -------------------- Found : 2006/01/12 Vendor Contacted : 2006/06/03 Release Date : 2006/06/10 About Snitz Forum : -------------------- Free, full featured asp+access Forum . Vulnerability: -------------------- SQL_Injection: Input passed to the %strCookieURL%.GROUP parameter via a cookie in 'inc_header.asp' is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Source: -------------------- inc_header.asp : . . . if strGroupCategories = "1" then if Request.QueryString("Group") = "" then if Request.Cookies(strCookieURL & "GROUP") = "" Then Group = 2 else Group = Request.Cookies(strCookieURL & "GROUP") end if else Group = cLng(Request.QueryString("Group")) end if 'set default Session(strCookieURL & "GROUP_ICON") = "icon_group_categories.gif" Session(strCookieURL & "GROUP_IMAGE") = strTitleImage 'Forum_SQL - Group exists ? strSql = "SELECT GROUP_ID, GROUP_NAME, GROUP_ICON, GROUP_IMAGE " strSql = strSql & " FROM " & strTablePrefix & "GROUP_NAMES " strSql = strSql & " WHERE GROUP_ID = " & Group set rs2 = my_Conn.Execute (strSql) . . . Proof of Concepts: -------------------- Nothing yet because a lot of sites are using this forum . Solution: -------------------- Change code : Group = Request.Cookies(strCookieURL & "GROUP") to this: Group = cLng(Request.Cookies(strCookieURL & "GROUP")) Thanks to "vendor" for their supporting . http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62049 Original Advisory: -------------------- http://www.kapda.ir/advisory-343.html Credit : -------------------- FarhadKey of KAPDA farhadkey [at} kapda <d0t> net Kapda - Security Science Researchers Insitute of Iran http://www.KAPDA.ir Grtz to : CVH , Pi3cH , Black_Death , DevilBox , Trueend5