Easy Blog XSS / SQL Injection / Shell Upload

`########## ADVISORY ##########  
  
  
==============================================  
Easy Blog by JM LLC - Multiple Vulnerabilities  
==============================================  
  
Software................: Easy Blog  
Software link...........: http://www.jmagness.com/download/Easy_Blog.zip  
Vendor..................: JM LLC  
Vendor homepage.........: http://www.jmagness.com  
  
Exploit author..........: Sp3ctrecore  
Contact.................: sp3ctrecore[at]gmail[dot]com  
  
  
--------  
OVERVIEW  
--------  
  
Easy Blog is affected by multiple vulnerabilities.  
  
  
-------------------  
DISCLOSURE TIMELINE  
-------------------  
  
04/07/2013 -- Multiple vulnerabilities discovered and reported to the vendor.  
19/07/2013 -- The vendor confirmed the vulnerabilities, but has no  
time to fix them.  
24/07/2013 -- Public disclosure.  
  
  
---------------  
VULNERABILITIES  
---------------  
  
[01] SHELL UPLOAD  
  
The image upload function in add.php allows unrestricted file upload.  
An attacker may upload a shell gaining unauthorized access to the  
system.  
  
  
[02] MULTIPLE SQL INJECTIONS  
  
I. add.php - filename parameter (POST request)  
An attacker may upload a file with a crafted name (e.g.  
"file.txt',(select version()))-- -") injecting SQL code.  
The content is readable in the homepage.  
  
II. edit.php - filename parameter (POST request)  
An attacker may upload a file with a crafted name (e.g.  
"file.txt',POST=(select version()) WHERE id=1-- -") injecting SQL  
code.  
The content is readable in the homepage.  
  
  
[03] MULTIPLE CROSS-SITE SCRIPTING  
  
I. add.php - title parameter (POST request): stored XSS.  
II. add.php - keywords parameter (POST request): stored XSS.  
III. add.php - description parameter (POST request): stored XSS.  
IV. add.php - slug parameter (POST request): reflected XSS.  
`