|
CyberBuild vuln.
###############################################
Vuln. discovered by : r0t
Date: 1 may 2006
vendorlink:www.smartwin.com.au/cyberbuild.htm
affected versions:last
orginal advisory:http://pridels.blogspot.com/2006/05/cyberbuild-vuln.html
###############################################
Vuln. Description:
1. SQL injection.
CyberOffice Warehouse Builder contains a flaw that allows a remote sql
injection attacks.Input passed to the "SessionID" parameter in "login.asp"
and input passed to the "ProductIndex" parameter in "browse0.htm" isn't
properly sanitised before being used in a SQL query. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.
examples:
/login.asp?SessionID=[SQL]
/browse0.htm?ProductIndex=[SQL]
2. XSS
contains a flaw that allows a remote cross site scripting attack. This flaw
exists because input passed to the "SessionID" parameter in "login.asp" and
input passed to the "ProductIndex" parameter in "browse0.htm" and input
passed to the "rowcolor","heading" parameter in "/include/result.asp" isn't
properly sanitised before being returned to the user.
This could allow a user to create a specially crafted URL that would execute
arbitrary code in a user's browser within the trust relationship between the
browser and the server, leading to a loss of integrity.
examples:
/login.asp?SessionID=[XSS]
/browse0.htm?ProductIndex=[XSS]
/include/result.asp?debug=print&cols=3&lineco
lor=%23AAAAAA&menu=category&body=bodyblue&bol
d=bodyheading&hlcolor=%2388C4FF&bgcolor=%23E
0FFE0&menucolor=%23E0FFE0&hdcolor=%23B0B0B0&
idcolor=%23FFFFFF&header=bodywhite&rowcolor=[XSS]
/include/result.asp?debug=print&cols=3&linec
olor=%23AAAAAA&menu=category&body=bodyblue&b
old=bodyheading&hlcolor=%2388C4FF&bgcolor=%2
3E0FFE0&menucolor=%23E0FFE0&hdcolor=%23B0B0
B0&idcolor=%23FFFFFF&header=bodywhite&rowco
lor=%23E0FFE0&row=bodyblack&label=bodyblue&
heading=[XSS]
###############################################
Solution:
Edit the source code to ensure that input is properly sanitised.
###############################################
More information @ unsecured-systems.com/forum/
|
