[NT] SiteEnable XSS and SQL injection

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  SiteEnable XSS and SQL injection
------------------------------------------------------------------------


SUMMARY

 <http://www.siteenable.com/default.asp> SiteEnable is "a simple content 
management, combined with powerful functionality". Two types security 
vulnerabilities have been found in the SiteEnable, one allows injecting 
arbitrary HTML and/or JavaScript, while the other allows injecting 
arbitrary SQL statements.

DETAILS

Cross Site Scripting:
Due to poor filtering of the 'contenttype' variable a remote user can 
inject arbitrary HTML and/or JavaScript into the content returned to the 
user:
http://site/content.asp?contenttype=%3Cscript%3Ealert(document.cookie)%3C/script%3E

Another more severe script injection is in the Submit a Quote page in 
which neither title or description fields are filtered. This can affect 
all the visitors of the site. Anyone can inject a silent script and grab 
anyone's password or cookie.

SQL Injection:
The 'sortby' parameter is directly passed to the SQL string without any 
checks. The following URL can be used to determine whether you are 
vulnerable or not:
http://site/content.asp?do_search=0&keywords=contact&page_no=2&sortby=;SELECT%20* FROM bla bla--


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
Zinho.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.