HELLO
You have injections SQL in all your query

For an windows server IIS + ASP
the loggin with ADMINISTRATOR ACCOUNT IS BYPASSABLE

!!
Please learn to devellop in php or .net

thanks for all your client.

EDIT :
folow:
http://www.tyrexpg.com.au/Settings.asp?Setting=Domains&A=Edit&U=152&D=-1%20union%20select%201

MySQL][ODBC 3.51 Driver][mysqld-5.0.67-community-nt]The used SELECT statements have a different number of columns

/Settings.asp, line 2698

it's in YOUR application :/
Goto: php is more easy to have an safety application.

sry for my english, i'm french
________________

Oh !
It's not about the sample version.
(so the sample have  sql injection on each query) (i had php in the title because i see injection in the code.)

In my compagny we have a full version,

Look the file into the directory SpamfilterWeb :

SpamFilterWeb$ find .
.
./css
./css/styles1.css
./default.asp
./images
./images/cal.gif
./images/double_left.gif
./images/submit_button_org.gif
./images/databoxes_right.gif
./images/right.gif
./images/databoxes_left.gif
./images/down.gif
./images/widget_close_box_dark.gif
./images/spacer.gif
./images/previous.gif
./images/up.gif
./images/next.gif
./images/last.gif
./images/left.gif
./images/expand.gif
./images/banner_logout.gif
./images/double_right.gif
./images/first.gif
./images/collapse.gif
./images/nav_carrot_orange.gif
./README.TXT
./db
./db/alter_tbllogins.sql
./db/create_tbl_logindomains.sql
./db/MySQL-Update-v3.5.3.695.sql
./classicasp
./classicasp/countries.asp
./classicasp/incExchangeDataBoxes.js
./classicasp/SubmitProfile.asp
./classicasp/css
./classicasp/css/styles1.css
./classicasp/sfdb.asp
./classicasp/ListUsers.asp
./classicasp/AssignRandPassword.asp
./classicasp/utils.asp
./classicasp/SubmitLogon.asp
./classicasp/Profile.asp
./classicasp/const.asp
./classicasp/default.asp
./classicasp/spf.asp
./classicasp/adovbs.inc
./classicasp/SubmitSuperUser.asp
./classicasp/incexchangedataboxes.asp
./classicasp/Login.asp
./classicasp/PasswordChange.asp
./classicasp/images
./classicasp/images/cal.gif
./classicasp/images/double_left.gif
./classicasp/images/submit_button_org.gif
./classicasp/images/databoxes_right.gif
./classicasp/images/right.gif
./classicasp/images/databoxes_left.gif
./classicasp/images/down.gif
./classicasp/images/widget_close_box_dark.gif
./classicasp/images/spacer.gif
./classicasp/images/previous.gif
./classicasp/images/up.gif
./classicasp/images/next.gif
./classicasp/images/last.gif
./classicasp/images/left.gif
./classicasp/images/expand.gif
./classicasp/images/banner_logout.gif
./classicasp/images/double_right.gif
./classicasp/images/first.gif
./classicasp/images/collapse.gif
./classicasp/images/nav_carrot_orange.gif
./classicasp/securecheck.asp
./classicasp/logoutdisplay.asp
./classicasp/setpwd.asp
./classicasp/FilterSettings.asp
./classicasp/ForgotPassword.asp
./classicasp/ResolveSpam.asp
./classicasp/ListSpam.asp
./classicasp/GetSetRecordsPerPage.asp
./classicasp/AddNew.asp
./classicasp/cleanup.asp
./classicasp/AssignSuperUser.asp
./classicasp/admin.asp
./classicasp/authenticate.asp
./classicasp/ResetDomainIncludeFirst.asp
./classicasp/logout.asp
./classicasp/black.asp
./classicasp/white.asp

ps "helo" from France



Edited by Thebras - 26 May 2011 at 11:41am

Well,

i know all your problems (je comprends tout tes problèmes en tant qu'administrateur réseaux.)
but :
Your application is download an usable by all,(Votre application est téléchargeable, et utilisable par n'importe qui, et n'importe qui peut lire sont code source.)
and if the vulnérabilites are know,(Et si les failles de sécurités sont analysé et découverte)
it's possible to an hacker to escalade priviliege and grant. (Il sera possible pour des hacker, de monter en privilèges, et d'obtenir un acces plus important sur le réseaux de la cible.)

To have an valid logon, you juste requiere to have an client acces.
(Pour avoir un compte valide, il suffit simplement d'être un client de l'entreprise et d'avoir un domaine à configurer sur spamfilter.)
Or not:(ou pas)
http://www.tyrexpg.com.au/emailrep.asp?l=152&d=%2812%20union%20select%201%20--%29&test=screen
this injection, (i not try to exploit it)
is accessible with no logon..
( cette injection sql, est utilisable, ainsi que beaucoup d'autres dans d'autres pages, sans être connecté sur le site.)

If the user of your application use classique password of mysql /mssql database it's possible to have an root acces easy on the server host,
and after : corrupt all the Local LAN.
(Si l'utilisateur de cette application utilise des identifiant classique pour la base mssql or mysql, tel que SA / root, il sera possible d'obtenir un acces root sur le server)

but, i like your interface spamfilter :) (mais j'aime bien votre interface)

""Look the file into the directory SpamfilterWeb : " i am unable to understand what you mean by this. please feel free to explain more.""

it's the listing file of my version "spamfilter web interface", compagny edtion.
(c'est la liste des fichiers de l'inteface web de configuration spam filter, qui n'est pas simplement un exemple, et utilisé par des clients.)

cordialement
:)