Description

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T18:17:15.113Z",
  "pubdate": "2026-08-13T18:17:15.113Z",
  "executiveSummary": "ASP-CMS contains an unauthenticated SQL injection vulnerability residing in the commentList.asp endpoint. The flaw enables remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database by manipulating the id parameter within HTTP GET requests.\nThe vulnerability allows threat actors to bypass the application's native keyword blocklist mechanism through payload obfuscation techniques, specifically by interleaving strings such as master within restricted SQL syntax. Successful exploitation results in unauthorized extraction of sensitive database contents.\nExploitation evidence was initially observed in the wild by the Shadowserver Foundation on October 18, 2023. The risk implications are severe due to the unauthenticated nature of the attack vector, potentially leading to complete compromise of the backend database repository.",
  "technicalDetails": "The vulnerability exists in the comment listing component of ASP-CMS, specifically within the commentList.asp script. The root cause is improper input validation and insufficient sanitization of user-supplied data passed via the id parameter in HTTP GET requests before it is concatenated into dynamic SQL queries executed by the database management system.\nNetwork exposure is fully remote and external attackers do not require authentication or prior privileges to interact with the vulnerable endpoint. Attackers leverage the GET method to transmit malicious SQL payloads directly to the commentList.asp script.\nTo achieve exploitation, attackers must navigate the application's keyword blocklist, which is designed to detect and block common SQL injection signatures. This is accomplished via payload obfuscation by interleaving strings like 'master' within restricted SQL terms. This technique evades pattern-matching security controls.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts an HTTP GET request targeting commentList.asp with a modified id parameter containing the obfuscated SQL injection payload. 2) The script processes the input and concatenates the malicious string into the SQL command without proper parameterization. 3) The blocklist fails to detect the obfuscated sequence due to the interleaved string manipulation. 4) The database executes the resulting query, allowing the attacker to extract sensitive database contents via error-based, union-based, or blind SQL injection techniques depending on the database configuration and payload structure.\nPost-exploitation impact includes unauthorized data exfiltration, disclosure of sensitive application and user information, and potential escalation of access depending on database user privileges."
}