lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070717100841.20985.qmail@securityfocus.com>
Date: 17 Jul 2007 10:08:41 -0000
From: joseph.giron13@...il.com
To: bugtraq@...urityfocus.com
Subject: Insanely simple blog - Multiple vulnerabilities

Insanely simple blog version 0.5 and below
http://sourceforge.net/projects/insanelysimple2

ISB contains multple vulnerabilities including both XSS, and SQL injection.

First off, the search action fails to strip user content for html allowing a user to input tags. Next, anonymous blog entries can contain javascript allowing script execution. How? Well, tags are stripped, and there is

As for the sql injection portion, several GET variables allow for the injection of SQL queries.

First of which is the current_subsection variable.

The following proof of concepts are provided

http://www.example.net/index.php?current_subsection=2 or 1=1/*
^^ dumps all table data.
http://www.example.net/index.php?current_subsection=2%20union%20all%20select blah from content/*


The following bits of code work on the blog.
<B onmousemver="javascript:alert('lol')">Pizza pie</B>
<OL onmouseover="alert('lol')">I like it</OL>

The fix for now is to filter blog entries with either a regex or the htmlspecialchars() function. The sql injection can be prevented by making sure the variables are numeric.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ