IISProtect Web Administration Interface SQL Injection Vulnerability

Bugtraq ID:	7675
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 23 2003 12:00AM
Updated:	May 23 2003 12:00AM
Credit:	Discovery is credited to Gyrniff <[email protected]>.
Vulnerable:	iisProtect iisProtect 2.2 iisProtect iisProtect 2.1
Not Vulnerable:

IISProtect Web Administration Interface SQL Injection Vulnerability

The IISProtect web administration interface does not properly sanitize user input. This could allow for SQL injection attacks on a Microsoft IIS server running IISProtect.

Successful exploitation could result in a compromise of the IISProtect server, attacks on the database or other consequences.

IISProtect Web Administration Interface SQL Injection Vulnerability

The following example was provided:

http://www.example.com/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20maste
r..xp_cmdshell'ping%2010.10.10.11';--

This example invokes the 'xp_cmdshell' stored procedure to execute the ping command on the host operating system.

IISProtect Web Administration Interface SQL Injection Vulnerability

Solution:
This vulnerability was reportedly fixed by the vendor, however, they have not acknowledged this publicly. Users are advised to contact the vendor for fix information.

IISProtect Web Administration Interface SQL Injection Vulnerability

References:

• iisProtect Homepage (iisProtect)
  
• iisPROTECT SQL injection in admin interface (Gyrniff )