Home page logo
/

bugtraq logo Bugtraq mailing list archives

Snitz Forum 3.3.03 Remote Command Execution
From: <sharpiemarker () hushmail com>
Date: Mon, 12 May 2003 13:53:40 -0700


Overview: 
Snitz Forums 2000, one of the best ASP based bulletin board systems on
the market. Getting better every day! A complete board system (forum)
that allows the user access to a friendly and intuitive interface.
http://forum.snitz.com 

Problem Description: 
Snitz Forums 3.3.03 has an SQL injection vulnerability in its "register.asp"
page with its "Email" variable. Because "register.asp" doesn't check
user input, remote users can execute stored procedures (such as "xp_cmdshell")
to arbitrarily run non-interactive commands on the system. 

Vendor Notification: 
Vendor notified last month. This is a deprecated version and users should

upgrade immediately. 

Versions Affected: 
3.3.03 
Most likely earlier versions (not tested) 

Fix: 
Upgrade to 3.4.03, the latest version. 

Exploit: 
Perl exploit already posted on VulnWatch mailing list.  It is archived
at the following locations:
http://archives.neohapsis.com/archives/vulnwatch/2003-q2/att-0067/snitz_exec.pl
http://lists.insecure.org/lists/vulnwatch/2003/Apr-Jun/att-0070/snitz_exec.pl



Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Big $$$ to be made with the HushMail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427


  By Date           By Thread  

Current thread:
  • Snitz Forum 3.3.03 Remote Command Execution sharpiemarker (May 12)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]