Snitz Forums inc_header.ASP SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1194617 漏洞类型 SQL注入
发布时间 2006-06-12 更新时间 2006-10-30
CVE编号 CVE-2006-2959 CNNVD-ID CNNVD-200606-212
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://cxsecurity.com/issue/WLB-2006060080
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200606-212
|漏洞详情
SnitzForum3.4.05及更早版本中的inc_header.asp存在SQL注入漏洞,远程攻击者可通过在一个cookie内的%strCookieURL%.GROUP参数来执行任意SQL命令。
|漏洞EXP
[KAPDA::#47] - Snitz Forum <= 3.4.05 SQL-Injection Vulnerability

KAPDA New advisory

Advisory Number: 47

Vulnerable products : Snitz Forum <= 3.4.05

Vendor: http://forum.snitz.com

Vulnerability: SQL_Injection

Date :

--------------------

Found : 2006/01/12

Vendor Contacted : 2006/06/03

Release Date : 2006/06/10

About Snitz Forum :

--------------------

Free, full featured asp+access Forum .

Vulnerability:

--------------------

SQL_Injection:

Input passed to the %strCookieURL%.GROUP parameter via a cookie in 'inc_header.asp' is not properly sanitised before being used in a SQL query.

This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Source:

--------------------

inc_header.asp :

.

.

.

if strGroupCategories = "1" then

if Request.QueryString("Group") = "" then

if Request.Cookies(strCookieURL & "GROUP") = "" Then

Group = 2

else

Group = Request.Cookies(strCookieURL & "GROUP")

end if

else

Group = cLng(Request.QueryString("Group"))

end if

'set default

Session(strCookieURL & "GROUP_ICON") = "icon_group_categories.gif"

Session(strCookieURL & "GROUP_IMAGE") = strTitleImage

'Forum_SQL - Group exists ?

strSql = "SELECT GROUP_ID, GROUP_NAME, GROUP_ICON, GROUP_IMAGE "

strSql = strSql & " FROM " & strTablePrefix & "GROUP_NAMES "

strSql = strSql & " WHERE GROUP_ID = " & Group

set rs2 = my_Conn.Execute (strSql)

.

.

.

Proof of Concepts:

--------------------

Nothing yet because a lot of sites are using this forum .

Solution:

--------------------

Change code :

Group = Request.Cookies(strCookieURL & "GROUP")

to this:

Group = cLng(Request.Cookies(strCookieURL & "GROUP"))

Thanks to "vendor" for their supporting .

http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62049

Original Advisory:

--------------------

http://www.kapda.ir/advisory-343.html

Credit :

--------------------

FarhadKey of KAPDA

farhadkey [at} kapda <d0t> net

Kapda - Security Science Researchers Insitute of Iran

http://www.KAPDA.ir

Grtz to : CVH , Pi3cH , Black_Death , DevilBox , Trueend5
|参考资料

来源:BID
名称:18362
链接:http://www.securityfocus.com/bid/18362
来源:BUGTRAQ
名称:20060610[KAPDA::#47]-SnitzForum<=3.4.05SQL-InjectionVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/436702/100/0/threaded
来源:MISC
链接:http://www.kapda.ir/advisory-343.html
来源:SECTRACK
名称:1016267
链接:http://securitytracker.com/id?1016267
来源:forum.snitz.com
链接:http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62049
来源:XF
名称:snitzforums-incheader-sql-injection(27080)
链接:http://xforce.iss.net/xforce/xfdb/27080
来源:SREASON
名称:1075
链接:http://securityreason.com/securityalert/1075