GotoCode Online Bookstore Multiple Vulnerabilities

vendor:

Online Bookstore

by:

Nathaniel Carew

7.5

CVSS

HIGH

Privilege Escalation / Remote Database Download

N/A

CWE

Product Name: Online Bookstore

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: MS Windows Server Standard 2003 SP2 / IIS 6

2011

GotoCode Online Bookstore Multiple Vulnerabilities

If the application is configured using the default directory structure and an access database then a user can download the access database. By modifying the Form_member_id and p_Form_member_id variables to the ID of the admin account (default ID is 7) on the MyInfo.aspx page in the POST data you can reset the admin password with the password you entered into the appropriate feed to gain full admin rights to the web application.

Mitigation:

Ensure that the application is not configured with the default directory structure and access database. Ensure that the admin account ID is not set to the default value of 7.

Source

Exploit-DB raw data:

###############################################################################
# Exploit Title : GotoCode Online Bookstore Multiple Vulnerabilities
# Vulnerability : Privilege Escalation / Remote Database Download
# Date      : 03/10/2011
# Author    : Nathaniel Carew
# Email	    : njcarew@gmail.com
# Impact    : High
# Software Link : http://www.gotocode.com/apps.asp?app_id=3&
# Platform  : ASP.NET
# Tested on : MS Windows Server Standard 2003 SP2 / IIS 6
# Thanks    : Peregrinus & Birch Meister General
###############################################################################
 
Overview:
---------
Database:
If the application is configured using the default directory structure and an
access database then a user can download the access database.

Privilege Escalation:
By modifying the Form_member_id and p_Form_member_id variables to the ID of the admin
account (default ID is 7) on the MyInfo.aspx page in the POST data you can reset the admin
password with the password you entered into the appropriate feed to gain full admin rights to the web application.

 
Proof of Concept:
-----------------
http://localhost/[path]/BookStore_MSAccess.mdb
http://localhost/[path]/MyInfo.aspx?p_Form_member_id=7&Form_member_id=7&Form_member_password=moo&Form_name=Administrator&Form_last_name=Account&Form_email=admin%40localhost&Form_address=&Form_phone=&Form_notes=&Form_card_type_id=1&Form_card_number=111111111111
 
Impact:
-------
By resetting the admin password an attacker would be able to completely control the application, users
and their associated data such as stored credit card information. Successful database exploitation
would allow an attacker to download the complete database of users information including email addresses
usernames, passwords, credit cards and associated billing and ordering data.