Vulnerabilities > CVE-2005-0949 - Input Validation vulnerability in Iatek PortalApp

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
iatek
nessus
NVD
Published: 2005-05-02
Updated: 2017-07-11

Summary

Multiple cross-site scripting (XSS) vulnerabilities in content.asp in Iatek PortalApp allow remote attackers to inject arbitrary web script or HTML via the (1) contenttype or (2) keywords parameter.

Vulnerable Configurations

Part Description Count
Application
Iatek
1

Nessus

NASL familyCGI abuses
NASL idPORTALAPP_INPUT_VALIDATION.NASL
descriptionThe remote host is running ASP PortalApp, a web application software written in ASP. There is a flaw in the remote software that could allow anyone to inject arbitrary SQL commands, which could in turn be used to gain administrative access on the remote host. In addition, a path disclosure and cross-site scripting vulnerability were reported, although Nessus has not checked for them.
last seen2020-06-01
modified2020-06-02
plugin id17653
published2005-03-30
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/17653
titleASP PortalApp Multiple SQL Injection
code
#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");

if(description)
{
 script_id(17653);
 script_cve_id("CVE-2005-0948", "CVE-2005-0949");
 script_bugtraq_id(12936);
 script_version("1.16");
 script_name(english:"ASP PortalApp Multiple SQL Injection");
 
 script_set_attribute(attribute:"synopsis", value:
"A remote web application is vulnerable to several flaws." );
 script_set_attribute(attribute:"description", value:
"The remote host is running ASP PortalApp, a web application software
written in ASP.

There is a flaw in the remote software that could allow anyone to inject
arbitrary SQL commands, which could in turn be used to gain administrative
access on the remote host.

In addition, a path disclosure and cross-site scripting vulnerability
were reported, although Nessus has not checked for them." );
 script_set_attribute(attribute:"solution", value:
"Upgrade to the latest version of this software." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);

 script_set_attribute(attribute:"plugin_publication_date", value: "2005/03/30");
 script_set_attribute(attribute:"vuln_publication_date", value: "2005/03/30");
 script_cvs_date("Date: 2018/07/25 18:58:03");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();

 script_summary(english: "SQL Injection");
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.");
 family["english"] = "CGI abuses";
 script_family(english:family["english"]);
 script_dependencie("http_version.nasl", "webmirror.nasl");
 script_require_ports("Services/www", 80);
 script_require_keys("www/ASP");
 exit(0);
}

# Check starts here

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");


port = get_http_port(default:80);

if (! can_host_asp(port:port)) exit(0);


function check(dir)
{
  local_var buf, r;
  r = http_send_recv3(method: "GET", item:dir + "/ad_click.asp?banner_id='", port:port);
  if (isnull(r)) exit(0);
  buf = r[0]+r[1]+'\r\n'+r[2];
  if("Microsoft JET"  >< buf && '80040e14' >< buf  )
  	{
	security_hole(port);
	set_kb_item(name: 'www/'+port+'/SQLInjection', value: TRUE);
	set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
	exit(0);
	}
 
 
 return(0);
}

check( dir:"");

References