AdMentor Remote SQL Injection Vulnerability
BID:4152
Info
AdMentor Remote SQL Injection Vulnerability
| Bugtraq ID: | 4152 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0308 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 21 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | Published by Frank <[email protected]>. |
| Vulnerable: |
Stefan Holmberg AdMentor 2.11 |
| Not Vulnerable: | |
Discussion
AdMentor Remote SQL Injection Vulnerability
AdMentor is a free collection of ASP scripts created by Stefan Holmberg. AdMentor provides banner ad rotation functionality.
A SQL injection vulnerability has been reported in some versions of AdMentor. During the login process, user supplied input is used to contruct a SQL query. If special characters such as ' are included in the 'userid' and 'pwd' parameters passed to the script, the query may be subverted.
It has been demonstrated that this can be used to authenticate as any account within the AdMentor system. It may be possible to further corrupt the query, although this has not been verified.
Other versions of AdMentor may share this vulnerability. This has not been verified.
AdMentor is a free collection of ASP scripts created by Stefan Holmberg. AdMentor provides banner ad rotation functionality.
A SQL injection vulnerability has been reported in some versions of AdMentor. During the login process, user supplied input is used to contruct a SQL query. If special characters such as ' are included in the 'userid' and 'pwd' parameters passed to the script, the query may be subverted.
It has been demonstrated that this can be used to authenticate as any account within the AdMentor system. It may be possible to further corrupt the query, although this has not been verified.
Other versions of AdMentor may share this vulnerability. This has not been verified.
Exploit / POC
AdMentor Remote SQL Injection Vulnerability
This vulnerability can be exploited with a web browser.
This vulnerability can be exploited with a web browser.
Solution / Fix
AdMentor Remote SQL Injection Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.