Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Zomplog Input Validation Holes Permit SQL Injection and Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1015088 |
|
SecurityTracker URL: http://securitytracker.com/id/1015088
|
|
CVE Reference:
CVE-2005-3308, CVE-2005-3309
(Links to External Site)
|
Updated: Jul 18 2008
|
Original Entry Date: Oct 21 2005
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
|
Description:
BiPi_HaCk of of Nightmare TeAmZ reported a vulnerability in Zomplog. A remote user can inject SQL commands. A remote user can conduct cross-site scripting attacks.
The software does not properly validate user-supplied input. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.
Some demonstration exploit URLs are provided:
/detail.php?id=[SQL]
/get.php?catid=[SQL]
/index.php?show=1&catid=[SQL]
Several scripts do not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the vulnerable software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Some demonstration exploit URLs are provided:
/detail.php?name=[XSS]
/get.php?username=[XSS]
/index.php?search=[XSS]
|
Impact:
A remote user can execute SQL commands on the underlying database.
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Zomplog software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: zomplog.zomp.nl/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 20 Oct 2005 17:48:02 +0200
Subject: Zomplog Multiple Vulnerability
|
------------------------------------------------------
Nightmare TeAmZ Advisory 011
------------------------------------------------------
Date - 10/2005
Zomplog Multiple Vulnerability
AFFECTED PRODUCTS
=================
Zomplog
http://zomplog.zomp.nl
OVERVIEW
========
Zomplog is an easy to use weblog system, that works out-of-the-box, while staying very
flexible in the way it can be applied. It supports all you would expect from a
weblog-system: image upload, categories, comments, skins, language files (currently
English, German, Dutch), search, BBcode editor, static pages, multiple users and an rss
feed, while staying easy to use for anyone. Starting from version 3.0 Zomplog also has
built-in support for moblogging: posting to your site through email or even your mobile
phone! All weblog settings can be managed through a control-panel. The latest version
turns your weblog into an audioblog and videoblog, supporting Quicktime video,
Realplayer video, Windows Media Player video and mp3's! Mp3's can be streamed using the
built-in flash mp3 player
POC
===
Sql Injection Vulnerable Path:
/detail.php?id=[SQL]
/get.php?catid=[SQL]
/index.php?show=1&catid=[SQL]
Xss Vulnerable Path:
/detail.php?name=[XSS]
/get.php?username=[XSS]
/index.php?search=[XSS]
Html Injection Vulnerable Path:
/detail.php?name=[HTML]
/get.php?username=[HTML]
/index.php?search=[HTML]
Solution:
=========
1. Venditor Not Contacted
Credits
=======
This vulnerability was discovered and researched by
BiPi_HaCk of Nightmare TeAmZ
We're: BiPi_HaCk - r3d_4Ss4ult3r - Sub_Z3r0
Site: http://www.NightmareTeAmZ.altervista.org <--IT Security Forum
_________________________________________________________________
Personalizza MSN Messenger con sfondi e fotografie! http://www.ilovemessenger.msn.it/
|
|
Go to the Top of This SecurityTracker Archive Page
|
