ASP-CMS SQL Injection via commentList.asp id Parameter
Impact
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
Source excerpt · VulnCheckAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
ASP-CMS Project · ASP-CMS
Other versions: affected
| Version / range | Source status |
|---|---|
| 0 | affected |
Original source description
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).
References
- Source reference web.archive.org/web/20201001011935/https://www.safeinfo.me/2019/07/22/aspcms-lou-dong-ji-he.html
- Source reference www.ddpoc.com/DVB-2021-821.html
- Source reference github.com/projectdiscovery/nuclei-templates/issues/7968
- Source reference web.archive.org/web/20220425041152/https://asp-cms.sourceforge.net/
- Security advisory www.vulncheck.com/advisories/asp-cms-sql-injection-via-commentlist-asp-id-parameter