Secunia

Trash-80 has reported some vulnerabilities in NEXTWEB (i)Site, which can be exploited by malicious people to cause a DoS (Denial of Service), conduct SQL injection attacks and disclose sensitive information.

1) Input passed to the "username" and "password" fields in "login.asp" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) User credentials are stored in the the "databases/Users.mdb" database file inside the web root, which can be exploited to disclose usernames and passwords.

3) An error in the handling of certain malformed requests can be exploited to cause a vulnerable service to become temporary unavailable.

Example:
http://[host]/isite/page/*.asp?mu=&cmu='

Solution
Edit the source code to ensure that input is properly sanitised and verified. Move the "Users.mdb" database file out of the web root.

Provided and/or discovered by
Trash-80, Zone-H Security Team

Changelog
Further details available in Customer Area

Original Advisory
http://www.zone-h.org/advisories/read/id=7605

Deep Links
Links available in Customer Area