[NT] Ublog Multiple Vulnerabilities (Cross Site Scripting, Database Disclosure)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Ublog Multiple Vulnerabilities (Cross Site Scripting, Database Disclosure)
------------------------------------------------------------------------


SUMMARY

 <http://www.uapplication.com> Ublog Reload is "a complete weblog system 
that makes Your web site look more professional".

Lack of user input filtering allows attackers to create a specially 
crafted URL that can be used to steal information from the Ublog Reload's 
users, in addition due to improper permission settings remote users can 
grab a copy of the database used by the product.

DETAILS

Vulnerable Systems:
 * Ublog version 1.0.4 and prior

Immune Systems:
 * Ublog version 1.0.5

Cross Site Scripting:
The parameter msg of the login.asp page allows attackers to create a 
JavaScript based code that can steal information from the users.

Proof of Concept:
The following URL can be used to trigger the vulnerability:
http://example/login.asp?msg=<script>alert( document.cookie )</script>

Information Disclosure:
The location of the database is stored in the directory of the web site. 
This allows any remote user to retrieve all of the information of the site 
stored in the database file.

Proof of Concept:
The following URL will retrieve the database stored on the remote site:
http://www.example.com/mdb-database/ublogreload.mdb


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
PersianHacker Team.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.