SQL injection vulnerability in register.asp in Snitz Forums 2000 before 3.4.03, and possibly 3.4.07 and earlier, allows remote attackers to execute arbitrary stored procedures via the Email variable.

The remote version of Snitz Forums 2000 is vulnerable to a SQL injection attack.  The domain name of the email address passed to the 'Email' parameter of 'register.asp' is not sanitized before being used in a SQL query.  A remote attacker could exploit this to execute arbitrary SQL queries.

Note this checks for a different vulnerability than BID 7549 (covered by Nessus plugins 14227 and 11621), even though the same parameter and page are affected.

The remote host seems to be running Snitz Forum, a web forum application implemented in ASP.  This version of Snitz is reported vulnerable to a SQL injection flaw within the 'email' parameter of the 'register.asp' script.  An attacker, exploiting this flaw, would send specially formed HTTP queries to the register.asp script.  These queries would include SQL statements which would ultimately be executed on the database utilized by Snitz.

The remote host is using Snitz Forum 2000.

This version allows an attacker to execute stored procedures and non-interactive operating system commands on the system. 

The problem stems from the fact that the 'Email' variable in the register.asp module fails to properly validate and strip out malicious SQL data.  

An attacker, exploiting this flaw, would need network access to the web server.  A successful attack would allow the remote attacker the ability to potentially execute arbitrary system commands through common SQL stored procedures such as xp_cmdshell.

The remote version of Snitz Forums 2000 is vulnerable to a SQL injection attack.  The 'Email' parameter of 'register.asp' is not sanitized before being used in a SQL query.  A remote attacker could exploit this to execute arbitrary SQL queries.

ID	Name	Product	Family	Severity
40470	Snitz Forums 2000 <= 3.4.07 register.asp 'Email' Parameter SQL Injection	Nessus	CGI abuses	high
5105	Snitz Forum < 3.4.0.08 SQL Injection	Nessus Network Monitor	CGI	high
14227	Snitz Forums 2000 < 3.4.03 register.asp Email Parameter SQL Injection	Nessus	CGI abuses	high
11621	Snitz Forums 2000 register.asp Email Parameter SQL Injection	Nessus	CGI abuses	high

Detections

Analytics

CVE-2003-0286

critical

Tenable Plugins

high

high

high

high