UblogXSS.txt

`  
  
[PersianHacker.NET 200503-11]Ublog reload 1.0.4 and prior Multiple Vulnerbilities  
Date: 2005 03  
Bug Number: 11  
  
Ublog  
Ublog reload is a complete ASP weblog system.  
More info @:  
http://www.uapplication.com  
  
  
Discussion:  
--------------------  
What are the bugs ?  
1) Cross-Site Scripting that lets attackers can inject HTML or Script.  
2) Default Database Name.  
  
Description bugs  
1)  
Input passed to the "msg" parameter in "login.asp" isn't properly sanitised before being returned to the user.  
Example :   
2)  
The problem is that the database file "mdb-database/ublogreload.mdb" is located inside the web root. so attackers can download it and disclose user/password of admin.  
attention : the admin's password is in the hash formating.  
  
Exploit:  
--------------------  
http://www.example.com/login.asp?msg=<script>alert(XSS)</script>  
http://www.example.com/mdb-database/ublogreload.mdb  
  
  
Solution:  
--------------------  
Upgrade to ublog reaload version 1.0.5  
  
  
Credit:  
--------------------  
Discovered by PersianHacker.NET Security Team  
by 3nitro (3nitro [AT] persianhacker [DOT] net)  
http://www.PersianHacker.NET  
  
Special Thanks: Pi3cH  
  
  
Help  
--------------------  
visit: http://www.PersianHacker.NET  
or mail me @: 3nitro [AT] persianhacker [DOT] net  
  
  
Note  
--------------------  
scripts authors contacted for this bug.  
`