lanuovastagione.it, il codice incriminato

17Sep/072

lanuovastagione.it, il codice incriminato

Continuiamo a parlare di lanuovastagione.it, un altro degli scandali italiani.
L'applicativo non solo ci mette a disposizione il web.config.. ma ci mostra anche il codice sorgente.

Sei giorni sono passati. Di risposte o di fix nemmeno l'ombra. Credo che i tempi siano maturi per rilasciare pubblicamente il codice sorgente. L'applicativo è sviluppato in Visual Basic.NET. E' stato scelto di non compilare il codice, ma di lavorare in codebehind lasciando i sorgenti direttamente all'interno del server. Questo significa che, per ogni pagina aspx presente è possibile recuperare il codice sorgente andando ad interrogare il relativo file .aspx.vb.
Prestate attenzione alle query e alla gestione delle variabili "template".

NB : Il ragionamento si applica anche ai seguenti siti.

http://www.diregiovani.it/
http://www.dsonline.it/
http://www.saperidemocratici.it/
http://www.italiafrica.it/
http://bologna07.festaunita.it/
http://byebye900.festaunita.it/

Buona lettura.

Live http://www.lanuovastagione.it/gw/producer/dettaglio.aspx
Link http://www.lanuovastagione.it/gw/producer/index.aspx?t=\gw\producer\dettaglio.aspx.vb

Partial Class gw_producer_dettaglio
Inherits System.Web.UI.Page
 
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
 
End Sub
    Protected Sub Page_PreRender(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.PreRender
        Dim id_doc As Integer = DOL.snippets.defval(Request("id_doc"), 0)
        Dim meta As System.Collections.Hashtable = New System.Collections.Hashtable
        Dim documento As storyega.documento = New storyega.documento(cenvironment.ConnectionString, id_doc)
        meta = documento.getMeta
        'checkRights(meta)
        Dim template As String = DOL.snippets.defval(Request("t"), "")
        
        If template.Length = 0 Then
            template = DOL.snippets.defval(DOL.utility.sql.getSQLSingleValue("select templatepath from gw_doc_plain where id=" & id_doc, cenvironment.ConnectionString), "/gw/template/dettaglio.htm")
        End If
 
        'CODICE SPECIFICO AXIA
     'Inserire qui il codice utente necessario per inizializzare la pagina
         Try
            glamwareadapter.initialize(Me, template, cenvironment.ConnectionString, "/", Me.Context, meta)
          Catch ex As Exception
            Response.Write("error on: " & template)
          'Response.Redirect("http://wwww.dsonline.it" & template & "?id_doc=" & id_doc)
        End Try
    End Sub
 
    Private Function getDataDoc(ByVal id_doc As Integer) As Date
        Dim sql As String = String.Format("SELECT data_doc FROM DOCUMENTO WHERE id_doc={0} ", id_doc)
        Dim datadoc As Date = Nothing
            Try
                datadoc = DOL.utility.DB.SQLClient.getSingleValue(cenvironment.ConnectionString, sql)
                Catch ex As Exception
            End Try
        Return datadoc
    End Function
End Class

Live http://www.lanuovastagione.it/gw/producer/index.aspx
Link : http://www.lanuovastagione.it/gw/producer/index.aspx?t=\gw\producer\index.aspx.vb

Partial Class gw_producer_index
 
Inherits System.Web.UI.Page
 
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
End Sub
 
    Protected Sub Page_PreRender(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.PreRender
    'Dim navman As StoryeGA.StoryeNavigationManager
    'navman = New StoryeGA.StoryeNavigationManager(Navigatore)
    'navman.connectionString = cenvironment.ConnectionString
    'navman.PageDimension = DOL.snippets.defval(Request("pd"), DOL.snippets.GetConfigKey("recperpage"))
     'Select Case DOL.snippets.defval(Request("o"), 1)
     ' Case 0
     ' navman.Sorting = dolClasses.dolTypes.Ordinamento.Crescente
     ' navman.sqlSortFieldName = "sortorder"
     ' Case 1
     ' navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
     ' navman.sqlSortFieldName = "sortorder"
     ' Case 2
     ' navman.Sorting = dolClasses.dolTypes.Ordinamento.Crescente
     ' navman.sqlSortFieldName = "ID"
     ' Case 3
     ' navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
     ' navman.sqlSortFieldName = "ID"
     ' Case 4
     ' navman.Sorting = dolClasses.dolTypes.Ordinamento.Crescente
     ' navman.sqlSortFieldName = "text3"
     ' Case 5
     ' navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
     ' navman.sqlSortFieldName = "ID"
     'End Select
     ' ''navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
     ' ''navman.sqlTableName = "VIEW_ATTR_VIDEOPOST_EXT"
     ' ''navman.sqlSortFieldName = "id_blogdoc"
     ' ''navman.go()
     ''Dim param As System.Collections.SortedList = New System.Collections.SortedList
     'Dim param As New System.Collections.Hashtable
     'param.Add("AREA", DOL.snippets.defval(Request("AREA"), Nothing))
     'param.Add("GPL", DOL.snippets.defval(Request("GPL"), Nothing))
     'param.Add("TIPODOC", DOL.snippets.defval(Request("TIPODOC"), Nothing))
     'Dim pipo As StoryeGA.ListDocNavmanagerMetaBuilder = New StoryeGA.ListDocNavmanagerMetaBuilder(cenvironment.ConnectionString, navman)
     'pipo.setParam(param)
     'Dim meta As System.Collections.Hashtable = New System.Collections.Hashtable
     'meta.Add("DOC", pipo.getMeta)
     'Dim template As String = DOL.snippets.defval(Request("t"), "")
     ''Inserire qui il codice utente necessario per inizializzare la pagina
     'Try
     ' glamwareadapter.initialize(Me, template, cenvironment.ConnectionString, "/", Me.Context, meta)
     'Catch ex As Exception
     ' Response.Write(ex.Message)
     ' Response.End()
     'End Try
     Dim navman As storyega.StoryeNavigationManager
     navman = New storyega.StoryeNavigationManager(Navigatore)
     navman.connectionString = cenvironment.ConnectionString
     navman.PageDimension = DOL.snippets.defval(Request("pd"), DOL.snippets.GetConfigKey("recperpage"))
    
    Select Case DOL.snippets.defval(Request("o"), 1)
         Case 0
             navman.Sorting = dolClasses.dolTypes.Ordinamento.Crescente
             navman.sqlSortFieldName = "sortorder"
         Case 1
             navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
             navman.sqlSortFieldName = "sortorder"
         Case 2
             navman.Sorting = dolClasses.dolTypes.Ordinamento.Crescente
             navman.sqlSortFieldName = "ID"
         Case 3
             navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
             navman.sqlSortFieldName = "ID"
         Case 4
             navman.Sorting = dolClasses.dolTypes.Ordinamento.Crescente
             navman.sqlSortFieldName = "text3"
         Case 5
             navman.Sorting = dolClasses.dolTypes.Ordinamento.Decrescente
             navman.sqlSortFieldName = "text3"
     End Select
     
     Dim param As System.Collections.Hashtable = New System.Collections.Hashtable
     param.Add("AREA", DOL.snippets.defval(Request("AREA"), Nothing))
     param.Add("GPL", DOL.snippets.defval(Request("GPL"), Nothing))
     param.Add("TIPODOC", DOL.snippets.defval(Request("TIPODOC"), Nothing))
 
     Dim pipo As storyega.ListDocNavmanagerMetaBuilder = New storyega.ListDocNavmanagerMetaBuilder(cenvironment.ConnectionString, navman)
     pipo.setParam(param)
     Dim meta As System.Collections.Hashtable = New System.Collections.Hashtable
     meta.Add("DOC", pipo.getMeta)
     Dim template As String = DOL.snippets.defval(Request("t"), "")
     'Inserire qui il codice utente necessario per inizializzare la pagina
     Try
     glamwareadapter.initialize(Me, template, cenvironment.ConnectionString, "/", Me.Context, meta)
         Catch ex As Exception
             Response.Write(ex.Message)
             Response.End()
         End Try
     End Sub
End Class

Live http://www.lanuovastagione.it/servizi/ec/contributi.aspx
Link http://www.lanuovastagione.it/gw/producer/index.aspx?t=\servizi\ec\contributi.aspx

Imports DOL.utility
 
Partial Class contributi
 Inherits System.Web.UI.Page
 
 Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
 'Inserire il codice da eseguire prima degli eventi di pagina
 End Sub
 
 Protected Sub Page_PreRender(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.PreRender
 'Inserire il codice da eseguire dopo gli eventi di pagina
 Dim template As String = DOL.snippets.defval(Request("t"), "")
     If template.Length = 0 Then template = "/servizi/ec/contributi.htm"
     'Inserire qui il codice utente necessario per inizializzare la pagina
     glamwareadapter.initialize(Me, template, cenvironment.ConnectionString, "/", Me.Context, Nothing)
End Sub
 
 Private Sub btInvia_Click(ByVal sender As System.Object, ByVal e As System.Web.UI.ImageClickEventArgs) Handles btInvia.Click
 If Page.IsValid Then
 
 ''' invia i dati alla banca
 'Inserire qui il codice utente necessario per inizializzare la pagina
 'Me.lblResult.Text = MAC
 Dim flag As Integer = 0
 
 Dim _importo As Long = Val(Me.txImporto.Text) * 100
 flag += 1
 Me.Label1.Text &= flag & " "
 Dim bankpass As New CBankPass
 bankpass = New CBankPass(_importo)
 flag += 1
 Me.Label1.Text &= flag & " "
 
 Dim rp As New DOL.RemotePost
     With rp
     .Add("IMPORTO", _importo)
     .Add("VALUTA", bankpass.Valuta)
     .Add("NUMORD", bankpass.Numord)
     .Add("IDNEGOZIO", bankpass.Idnegozio)
     flag += 1
     Me.Label1.Text &= flag & " "
     .Add("URLBACK", bankpass.Urlback & "?NUMORD=" & Server.UrlEncode(bankpass.Numord))
     flag += 1
     Me.Label1.Text &= flag & " "
     .Add("URLDONE", bankpass.Urldone)
     .Add("URLMS", bankpass.Urlms)
     .Add("TCONTAB", bankpass.Tcontab)
     .Add("TAUTOR", bankpass.Tautor)
     .Add("MAC", bankpass.MACRequest(Me.Server))
     flag += 1
     Me.Label1.Text &= flag & " "
     .Url = bankpass.Bankpassurl
 
     ' prima di inviare salvo su database il tentativo di transazione
     Dim sql As String = ""
     Dim fields As New System.Collections.Specialized.NameValueCollection
         With fields
         .Add("nome", DB.Common.SQLTConv(Me.txNome.Text))
         .Add("cognome", DB.Common.SQLTConv(Me.txCognome.Text))
         .Add("email", DB.Common.SQLTConv(Me.txEmail.Text))
         .Add("telefono", DB.Common.SQLTConv(Me.txTelefono.Text))
         .Add("citta", DB.Common.SQLTConv(Me.txCitta.Text))
         .Add("cap", DB.Common.SQLTConv(Me.txCap.Text))
         .Add("provincia", DB.Common.SQLTConv(Me.txProvincia.Text))
         .Add("importo", DB.Common.SQLNConv(CType(_importo, Double) / 100.0))
         .Add("valuta", DB.Common.SQLNConv(bankpass.Valuta))
         .Add("numord", DB.Common.SQLTConv(bankpass.Numord))
         .Add("tcontab", DB.Common.SQLTConv(bankpass.Tcontab))
         .Add("tautor", DB.Common.SQLTConv(bankpass.Tautor))
         .Add("inlist", IIf(Me.ckPublic.Checked, 1, 0))
         End With
         Me.Label1.Text &= flag & " "
         .Url = bankpass.Bankpassurl
 
     sql = DB.Common.BuildSQLINSERT("LOOKUP_TRANSAZIONI", fields)
     Me.Label1.Text &= "<br>" & sql & "<br>" & cenvironment.ConnectionString
     'Exit Sub
         Try
             DB.SQLClient.doexec(cenvironment.ConnectionString, sql)
             'Me.Label1.Text &= flag & " "
             'Exit Sub
             '.Url = bankpass.Bankpassurl
            .Post()
         Catch ex As Exception
            Me.Label1.Text = ex.Message
         Finally
    End Try
    End With
End If
End Sub
 
    Private Sub CustomValidator1_ServerValidate(ByVal source As System.Object, ByVal args As System.Web.UI.WebControls.ServerValidateEventArgs) Handles CustomValidator1.ServerValidate
    args.IsValid = IsNumeric(Me.txImporto.Text)
        
        If Not args.IsValid Then
            Return
        End If
        
        For i As Integer = 1 To Me.txImporto.Text.Length
        Dim s As String = Mid(Me.txImporto.Text, i, 1)
            If Not ("0" <= s And s <= "9") Then
                args.IsValid = False
                Return
            End If
        Next
        args.IsValid = True
    End Sub
End Class

About Alessio Marziali

Alessio Marziali (MCTS) is a Security Consultant with 9 years of experience developing secure applications with Microsoft .NET in a variety of sectors in UK and Italy. Published technical author with two ASP.NET books currently available for purchase and OWASP Code Crawler Project Leader.

Filed under: .NET, Advisory, Vulnerabilità, riflessioni Leave a comment

Comments (2) Trackbacks (0) ( subscribe to comments on this post )

Giorgio Maone
September 28th, 2007 - 10:13

Sbagliare è umano.
Perseverare per 16 giorni (dal primo advisory, 12 SET ad oggi, 28 SET) è idiota… er… italiota.
Normalmente preferisco “responsible disclosure” o almeno RFPolicy, ma in questo caso, evidentemente, il tempo ti ha dato ragione.
Ciao
enzo
October 4th, 2007 - 14:11

Beh non male, se questa e la nuovastagione, era meglio “er puzzone”.
Se non sapete chi e’ ve lo posso dire io

Grande A