PBLGuestbook132.txt

`/*  
--------------------------------------------------------  
[N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06  
--------------------------------------------------------  
Program: PBL Guestbook  
Homepage: www.pixelatedbylev.com  
Vulnerable Versions: 1.32 and lower.  
Risk: High!  
Impact: Critical Risk  
  
-==PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities==-  
---------------------------------------------------------  
  
- Description  
---------------------------------------------------------  
PBL Guestbook fully functional guestbook loaded with tons of features and packed for premium optimization and performance.  
  
- Tested  
---------------------------------------------------------  
PBL Homepage & other sites  
  
- Explotation  
---------------------------------------------------------  
  
1)  
  
Vulnerable code:  
  
  
==[ pblguestbook.php 164-183 ]==========================  
[...]  
if ($id){  
foreach ($_POST as $name => $value)  
{  
$_POST["$name"] = str_replace("\n","<BR>",$value);  
}  
foreach ($_POST as $name => $value)  
{  
$_POST["$name"] = str_replace("\t","",$value);  
}  
foreach ($_POST as $name => $value)  
{  
$_POST["$name"] = str_replace("\r","",$value);  
}  
foreach ($_POST as $name => $value)  
{  
$_POST["$name"] = str_replace('|',"¦",$value);  
}  
foreach ($_POST as $name => $value)  
{  
$_POST["$name"] = preg_replace("/\<SCRIPT(.*?)\>(.*?)\<\/SCRIPT(.*?)\>/i", "SCRIPT BLOCKED", $value);  
}  
[...]   
==[ end pblguestbook.php ]==========================  
  
How we can see the script only do some replaces. Only the <script> tag is filtered, but we can include javascript code with   
other tags.  
  
Here you have some values for the name, message, website and e-mail.  
  
PoC:  
---------------------------------------------------------  
  
value: <a onMouseOver="javascript: location.href='http://google.com';" href="#"><h1>TOUCH ME</h1></a>  
value: <iframe src="http://somesite.com"></iframe>   
  
2)  
  
The PBL Guestbook don't use MySQL databases to save the admin info, so it's no very useful give many importance. However, p.e.  
in the next code there's no simple quotes filtering ('). The used variables are the same that we saw in the pasted code:  
  
==[ pblguestbook.php 220-224 ]==========================  
[...]  
$query = "INSERT INTO `pblguestbook_posts` (`name`,`email`,`ip`,`time`,`website`,`customq1`,`customq2`,";  
$query .= "`customq3`,`customq4`,`customq5`,`rate`,`comments`,`private`,`app`) VALUES('$_POST[name]',";  
$query .= "'$_POST[email]','$_SERVER[REMOTE_ADDR]','$time','$_POST[website]',";  
$query .= "'$conqd1','$conqd2','$conqd3','$conqd4','$conqd5',";  
$query .= "'$_POST[rate]','$_POST[comments]','$_POST[private]','$appmode')"  
[...]  
==[ end pblguestbook.php ]==========================  
  
If magic_quotes_gpc is off, just add one simple quote at the final of the name, email, web or message and you'll see that the  
script can add the post because there was a problem with the sql query.  
  
- How to fix it? More information?  
--------------------------------------------------------  
Visit our forum to know how to fix it or to get more information.  
http://www.neosecurityteam.net/foro/  
  
- References  
--------------------------------------------------------  
http://www.neosecurityteam.net/index.php?action=advisories&id=23  
  
- Credits  
--------------------------------------------------------  
Discovered by Paisterist -> paisterist.nst [at] gmail [dot] com  
  
[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/  
  
  
- Greets  
--------------------------------------------------------  
HaCkZaTaN  
K4P0  
Daemon21  
Link  
LINUX  
m0rpheus  
  
Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!  
  
@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@  
'@@@@@''@@'@@@''''''''@@''@@@''@@  
'@@'@@@@@@''@@@@@@ @@@'''''@@@  
'@@'''@@@@'''''''''@@@''''@@@  
@@@@''''@@'@@@@@@@@@@''''@@@@@  
  
/* EOF */  
`