bugtraq - Vulnerability in myBloggie 2.1.3-beta and prior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 5 Sep 2005 06:56:24 -0000
From: os2a.bto@...il.com
To: bugtraq@...urityfocus.com
Subject: Vulnerability in myBloggie 2.1.3-beta and prior

OS2A

myBloggie SQL Injection/Privilege Escalation Vulnerability

OS2A ID: OS2A_1002				Status
						9/1/2005 Isse Discovered
						9/2/2005 Reported to the vendor
						9/3/2005 Patch Released							
						9/5/2005 Advisory Released

Class: SQL Injection				Severity: CRITICAL

Overview:
myBloggie is a Weblog system built using PHP & mySQL. myBloggie versions 
2.1.3-beta and prior are vulnerable to SQL injection vulnerability caused
by improper validation of user-supplied inputs. This vulnerability can be 
exploited to bypass authentication mechanism, escalate the privileges to
administrator level and also made to reveal system specific information. 

Description:
User supplied credential inputs ('$username' and '$passwd') are not sanitized 
in login.php before subjecting them to SQL query. 

<----------------------------login.php snippet--------------------------------->

if (isset($_POST['username'])) {
$username=$_POST['username'];
} else $username="";

$result = mysql_query( "SELECT user FROM ".USER_TBL." WHERE user='$username'
                  AND password='$passwd'" ) or error( mysql_error() );

<------------------------------------------------------------------------------>

This can be exploited in multiple ways,
1. Authentication Bypass
   A malicious user can log on to the weblog system without submitting the 
   password by placing queries such as this "admin' OR 'x'='x" in the 
   User Name field.

2. Privilege Escalation.
   When a non-administrative user submits, for example "user1' OR 'x'='x",
   into the User Name field, administrative privileges will be granted. 

3. Path Disclosure.
   Path information can be made to disclose in error pages by passing invalid 
   query to User Name field of login.php.

Impact:
Successful exploitation can result in a compromise of the application, 
disclosure of system specific information, or permit an attacker to 
exploit vulnerabilities in the underlying database implementation. 
An attacker can also exploit this vulnerability to elevate privileges 
within the affected system.

Affected Systems:
myBloggie 2.1.3-beta and prior.
Linux (Any), Unix (Any), Windows (Any)

Exploit:
 1. POST http://example.com/mybloggie/login.php?username=admin' OR 'x'='x
 2. POST http://example.com/mybloggie/login.php?username=normal_user' OR 'one'='one
 3. POST http://example.com/mybloggie/login.php?username='1=1 --

Solutions:
	Patch: http://mywebland.com/forums/showtopic.php?t=399