ASPNuke <= 0.80 (register.asp) Remote SQL Injection Vulnerability
ASP Nuke is an open-source software application for running a community-based web site on a web server. By open-source, we mean the code is freely available for others to read, modify and use in accordance with the software license. ASP Nuke is an extensible framework that allows you to upgrade and add applications to the website quickly and easily. It uses a modular architecture allowing others to rapidly develop new modules and site operators to re-organize the layout and navigation for their site. An attacker can exploit a SQL injection vulnerability in the register.asp page of ASPNuke version 0.80 and earlier to execute arbitrary SQL commands on the underlying database. The vulnerable parameter is the StateCode parameter, which is not properly sanitized before being used in a SQL query. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL statements to the register.asp page.
