bugtraq - MyBlog <=0.9.8 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080720165618.s8794t7udcscskw8@mail.amnpardaz.com>
Date: Sun, 20 Jul 2008 16:56:18 +0430
From: admin@...report.ir
To: bugtraq@...urityfocus.com
Subject: MyBlog <=0.9.8 Multiple Vulnerabilities

########################## www.BugReport.ir  
#######################################
#
#		AmnPardaz Security Research Team
#
# Title: MyBlog <=0.9.8 Multiple Vulnerabilities
# Vendor: http://crewdesign.co.uk & http://sourceforge.net/projects/myblog
# Exploit: Available
# Vulnerable Version: 0.9.8
# Impact: High
# Fix: N/A
# Original Advisory: www.bugreport.ir/?/49
###################################################################################

####################
1. Description:
####################
	MyBlog(CMS) is an open source Blog/CMS project. MyBlog(CMS) was  
created as an expandable and easy to use system to manage your website  
with. Its best feature is its customisability, you could use it to run  
your whole site around with forum modules, photo gallery modules and  
all that jazz or you could just run a simple add-on blog using it.
####################
2. Vulnerabilities:
####################
	2.1. Information Leakage. Database information disclosure in  
"/config/mysqlconnection.inc" and/or  
"/config/mysqlconnection%20-%20Copy.inc" or "/admin/setup.php".
		2.1.1. Exploit:
						Check the exploit/POC section.
	2.2. Cross Site Scripting (XSS). Reflected XSS attack in "index.php"  
in "sort" and "s" parameters.
		2.2.1. Exploit:
						Check the exploit/POC section.
	2.2. Cross Site Scripting (XSS). Reflected XSS attack in "post.php"  
in "id" parameter.
		2.2.1. Exploit:
						Check the exploit/POC section.
	2.4. Information Leakage. Source code disclosure in "/config/settings.inc".
		2.4.1. Exploit:
						Check the exploit/POC section.
####################
3. Exploits/POCs:
####################
	Original Exploit URL: http://bugreport.ir/index.php?/49/exploit
####################
4. Solution:
####################
	Edit the source code to ensure that inputs are properly sanitized.  
Rename the mentioned files in section 2.1, 2.4 and wait for vendor  
patch.
####################
5. Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com