bugtraq - myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection technique

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <201106152247.p5FMl4iF013253@sf01web1.securityfocus.com>
Date: Wed, 15 Jun 2011 22:47:04 GMT
From: info@...inverton.de
To: bugtraq@...urityfocus.com
Subject: myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection
 technique

myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection technique

Software: myBloggie 2.1.6
Severity: High
Author: Robin Verton <info (at) robinverton (dot) de>
Date: Jun. 12 2011
Vendor: http://mybloggie.mywebland.com/

Software Description:

"myBloggie is considered one of the most simple, user-friendliest yet packed with features Weblog system available to date."

Issue details:

myBloggie 2.1.6 is - again - prone to a SQL-Injection vulnerability in the trackback function. It is possible to add a malformed URL to a trackback so malicious code can be injected to insert/read out data from the database.

An unsafe regular expression which does not properly check the passed trackback-url can be bypassed to inject malicious data into an INSERT INTO statement, resulting in an persistent cross-site-scripting or be used for reading out sensitive data (see 'Advanced INSERT INTO exploitation by taking advantage of the primary key' described here [1]).

Technical details:

trackback.php - Line 33-35

 $url=urldecode($_REQUEST['url']);
 if (validate_url($url)==false) { $tback->trackback_reply(1, "<p>Sorry, Trackback failed.. Reason : URL not valid</p>"); }

function.php - Line 750-755

 function validate_url($url) {
 if  ( ! preg_match('#^http\\:\\/\\/[a-z0-9\-]+\.([a-z0-9\-]+\.)?[a-z]+#i', $url, $matches) ) {
        return false ;}
        else {
      return true;  }
 }

As you can see the end of the passed $url in the regular expression is not defined. By providing an URL like http://example.com'INJECTION the filter can be bypassed.

Timeline:
12. July 2011 - Bug found.
12. July 2011 - Vendor contacted.
15. July 2011 - Full disclosure.

References:
[0] Original advisory: http://robinverton.de/blog/mybloggie-2-1-6-sql-injection-persistent-xss
[1] http://robinverton.de/blog/advanced-insert-into-injection-by-taking-advantage-of-the-primary-key