[FD] Microsoft MSN HBE - Blind SQL Injection Vulnerability

Document Title:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Microsoft MSN HBE - Blind SQL Injection Vulnerability


References (Source):
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
http://www.vulnerability-lab.com/get_content.php?id=3D1183

Video: http://www.vulnerability-lab.com/get_content.php?id=3D1282

Vulnerability Magazine: http://vulnerability-db.com/magazine/articles/2014/=
07/17/vl-core-team-published-blind-sql-injection-vulnerability-video-poc-ms=
rc


Release Date:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
2014-07-17


Vulnerability Laboratory ID (VL-ID):
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
1183


Common Vulnerability Scoring System:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
9.1


Product & Service Introduction:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D
MSN (originally The Microsoft Network; stylized as msn) is a collection of =
Internet sites and services provided by Microsoft. =

The Microsoft Network debuted as an online service and Internet service pro=
vider on August 24, 1995, to coincide with the =

release of the Windows 95 operating system. The range of services offered b=
y MSN has changed since its initial release in 1995. =

MSN was once a simple online service for Windows 95, an early experiment at=
 interactive multimedia content on the Internet, =

and one of the most popular dial-up Internet service providers. MSN was pri=
marily a popular Internet portal. Microsoft used =

the MSN brand name to promote numerous popular web-based services in the la=
te 1990s, most notably Hotmail and Microsoft =

Messenger service, before reorganizing many of them in 2005 under another b=
rand name, Windows Live. MSN.com was the 17th most =

visited domain name on the Internet.

(Copy of the Vendor Homepage: http://www.msn.com )


Abstract Advisory Information:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
The vulnerability laboratory research team has discovered a critical blind =
sql injection vulnerability in one of the official MSN network web-applicat=
ion.


Vulnerability Disclosure Timeline:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
2014-01-27:	Researcher Notification & Coordination (Ateeq ur Rehman Khan)
2014-01-28:	Vendor Notification (Microsoft Security Response Center)
2014-03-13:	Vendor Response/Feedback (Microsoft Security Response Center)
2014-07-16:	Vendor Fix/Patch  (by Vulnerability Laboratory Check)
2014-07-17:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Published


Exploitation Technique:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Remote


Severity Level:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Critical


Technical Details & Description:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D
A boolean-based blind SQL Injection web vulnerability has been detected in =
the official MSN (habitos.be.msn.com) web application Service.
The vulnerability allows remote attackers to inject own sql commands to com=
promise the affected web-application and connected dbms. =


The SQL Injection vulnerability is located in the item.asp file. The vulner=
able parameter to inject the sql commands is `item_id`.
Remote attacker are able to inject own sql commands to the item_id value in=
 the item.asp file GET method request. The issue is a =

blind injection and the attack type is boolean based. The security risk of =
theremote sql injection web vulnerability =

is estimated as critical with a cvss (common vulnerability scoring system) =
count of 9.1.

The remote sql injection web vulnerability can be exploited by remote attac=
kers without privileged application user account =

and without required user interaction. Successful exploitation of the sql i=
njection vulnerability results in application and =

web-service or dbms compromise.

Vulnerable Domain(s):
				[+] habitos.be.msn.com

Vulnerable file(s):
				[+] item.asp

Vulnerable Parameter(s):
				[+] item_id


Proof of Concept (PoC):
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The remote blind sql injection vulnerability can be exploited by remote att=
ackers without user interaction or =

privileged web-application user account. For security demonstration or to r=
eproduce the vulnerability follow the =

provided steps and information below. =



Request #1
http://habitos.be.msn.com/item.asp?item_id=3D98%27%20AND%208606=3DBENCHMARK=
(1000000,MD5(0x4964554a))%20AND%20%27xPUE%27=3D%27xPUE


Request #2
http://habitos.be.msn.com/item.asp?item_id=3D98%27%20AND%208606=3DBENCHMARK=
(5000000,MD5(0x4964554a))%20AND%20%27xPUE%27=3D%27xPUE


Solution - Fix & Patch:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The vulnerability can be patched by a secure restriction and parse or encod=
e of the vulnerable item_id value GET method request.


Security Risk:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The security risk of the remote blind sql injection web vulnerability is es=
timated as critical.


Credits & Authors:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Vulnerability Laboratory [Research Team] - Ateeq ur Rehman Khan [ateeq@evol=
ution-sec.com] (@OhTheITGuy) [www.vulnerability-lab.com]


Disclaimer & Information:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
The information provided in this advisory is provided as it is without any =
warranty. Vulnerability Lab disclaims all warranties, either =

expressed or implied, including the warranties of merchantability and capab=
ility for a particular purpose. Vulnerability-Lab or its suppliers =

are not liable in any case of damage, including direct, indirect, incidenta=
l, consequential loss of business profits or special damages, even =

if Vulnerability-Lab or its suppliers have been advised of the possibility =
of such damages. Some states do not allow the exclusion or limitation =

of liability for consequential or incidental damages so the foregoing limit=
ation may not apply. We do not approve or encourage anybody to break =

any vendor licenses, policies, deface websites, hack into databases or trad=
e with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- ww=
w.evolution-sec.com
Contact:    [email protected] 	- [email protected] 	=
       		- admin-sRlC7LJHFRmvt2SHZzvQTwC/[email protected]
Section:    dev.vulnerability-db.com	 	- forum.vulnerability-db.com 		     =
  		- magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	    =
   		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rs=
s_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list=
-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file=
 requires authorization from Vulnerability Laboratory. Permission to =

electronically redistribute this alert in its unmodified form is granted. A=
ll other rights, including the use of other media, are reserved by =

Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advi=
sories, source code, videos and other information on this website =

is trademark of vulnerability-lab team & the specific authors or managers. =
To record, list (feed), modify, use or edit our material contact =

([email protected] or [email protected]) to get a pe=
rmission.

				Copyright =A9 2014 | Vulnerability Laboratory [Evolution Security]



-- =

VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: [email protected]



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/