Full Revolution aspWebCalendar and aspWebAlbum Multiple SQL Injection Vulnerabilities
BID:11246
Info
Full Revolution aspWebCalendar and aspWebAlbum Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 11246 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2004 12:00AM |
| Updated: | Sep 24 2004 12:00AM |
| Credit: | Discovery of this issue is credited to Pedro Sanches <[email protected]>. |
| Vulnerable: |
Full Revolution aspWebMail 1.0 Full Revolution aspWebHeadlines 1.1 Full Revolution aspWebCalendar 4.5 Full Revolution aspWebAlbum 3.2 |
| Not Vulnerable: | |
Discussion
Full Revolution aspWebCalendar and aspWebAlbum Multiple SQL Injection Vulnerabilities
Reportedly Full Revolution aspWebCalendar and aspWebAblum are affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.
An attacker may leverage these issues to manipulate SQL queries to the underlying database. This may allow the attacker access to sensitive information, such as the administrator password, to corrupt data and to carry out other attacks.
Reportedly Full Revolution aspWebCalendar and aspWebAblum are affected by multiple SQL injection vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.
An attacker may leverage these issues to manipulate SQL queries to the underlying database. This may allow the attacker access to sensitive information, such as the administrator password, to corrupt data and to carry out other attacks.
Exploit / POC
Full Revolution aspWebCalendar and aspWebAlbum Multiple SQL Injection Vulnerabilities
No exploit is required to leverage this issue. The following proof of concept exploits have been provided:
Entering the following text into an offending field or passing it through an offending parameter will yield the administrator password and present it to the attacker:
' union select Cal_User_Password,1,1,1,1,1,1,1,1,1 from Cal_User where
Cal_User_UserName = 'admin'--
No exploit is required to leverage this issue. The following proof of concept exploits have been provided:
Entering the following text into an offending field or passing it through an offending parameter will yield the administrator password and present it to the attacker:
' union select Cal_User_Password,1,1,1,1,1,1,1,1,1 from Cal_User where
Cal_User_UserName = 'admin'--
Solution / Fix
Full Revolution aspWebCalendar and aspWebAlbum Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Full Revolution aspWebCalendar and aspWebAlbum Multiple SQL Injection Vulnerabilities
References:
References:
- aspWebAlbum Home Page (Full Revolution)
- aspWebCalendar Home Page (Full Revolution)
- Full Revolution Homepage (Full Revolution)
- aspWebCalendar /aspWebAlbum: SQL injection (Pedro Sanches