by r0t,der4444,cembo,VietMafia

Thursday, March 23, 2006

AdMan v1.0.x SQL vuln

##########################################
Vuln. discovered by : r0t
Date: 23 march 2006
vendor:www.formfields.com/adManArea/
affected versions: v1.0.20051221 and prior
#########################################
SQL vuln.

AdMan contains a flaw that allows a remote sql injection attacks.Input passed to the "transactions_offset" parameter in "advertiser/viewStatement.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code


example:

/adMan/advertiser/viewStatement.php?start_date_date_month=03
&start_date_date_day=01&start_date_date_year=2008&start_date
_time_hour=12&start_date_time_min=00&start_date_time_amPm=AM
&end_date_date_month=&end_date_date_day=&end_date_date_year=
&end_date_time_hour=&end_date_time_min=&end_date_time_amPm=&
_submit=&transactions_offset=[SQL]

#########################################

+

To get full install. path:

/adMan/advertiser/editCampaign.php?campaignId=
/adMan/advertiser/viewPricingScheme.php?schemeId=

#########################################

Solution:

Edit the source code to ensure that input is properly sanitised.

########################################

You can discuz about that vuln.
@ unsecured-systems.com/forum

0 Comments:

Post a Comment

<< Home

 
Copyright (c) 2006 Pridels Sec Crew