Eggblog <= 3.x Multiple Remote Vulnerabilities

2006.06.01
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

These issues have been fixed as of v3.07. v2 is not supported and should no longer be available to download. Please let me know if this is not the case. Thanks, Egg www.eggblog.net -----Original Message----- From: Mustafa Can Bjorn IPEKCI [mailto:nukedx (at) nukedx (dot) com [email concealed]] Sent: 28 May 2006 15:01 To: submit (at) milw0rm (dot) com [email concealed]; full-disclosure (at) lists.grok.org (dot) uk [email concealed]; bugtraq (at) securityfocus (dot) com [email concealed]; egg (at) epicdesigns.co (dot) uk [email concealed] Subject: Advisory: Eggblog <= 3.x Multiple Remote Vulnerabilities --Security Report-- Advisory: Eggblog <= 3.x Multiple Remote Vulnerabilities --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 27/05/06 06:15 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: http://www.nukedx.com } --- Vendor: Eggblog (http://www.eggblog.net/) Version: 3.0.6 and prior versions must be affected. About: Via this method remote attacker can inject arbitrary SQL queries to Eggblog.This SQL injection works with Eggblog version 3.0.6 and below.The problem is that id parameter id rss/posts.php did not sanitized properly before using it in SQL query.This caused to remote attacker inject arbitrary SQL queries and execute them.This SQL injection needs magic_quotes_gpc off. There is another problem in Eggblog 2.x.In registration member register status did not sanitized properly.This caused to remote attacker "register new member" as a admin nick and get administration privileges on Eggblog. Level: Critical --- How&Example: GET -> http://[site]/[EggBlog]/rss/posts.php?id=SQL EXAMPLE -> http://[site]/[EggBlog]/rss/posts.php?id=1'/**/UNION/**/SELECT/**/0,conc at(' Username:%20',username), concat('Password:%20',password)/**/from/**/eggblog_members/* POST/EXAMPLE -> http://[site]/[EggBlog]/home/register.php?username=victim&password=passw ord& email=e (at) mail (dot) com [email concealed]&ref= -- Timeline: * 27/05/2006: Vulnerability found. * 27/05/2006: Contacted with vendor and waiting reply. --- Exploit: http://www.nukedx.com/?getxpl=36 --- Original advisory can be found at: http://www.nukedx.com/?viewdoc=36


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top