myBloggie SQL Injection/Privilege Escalation Vulnerability

OS2A ID: OS2A_1002

Status
9/1/2005 Issue Discovered
9/2/2005 Reported to the vendor
9/3/2005 Patch Released
9/5/2005 Advisory Released

Class: SQL Injection Severity: CRITICAL

Overview:
myBloggie is a Weblog system built using PHP & mySQL. myBloggie
versions2.1.3-beta and prior are vulnerable to SQL injection vulnerability
causedby improper validation of user-supplied inputs. This vulnerability
can be exploited to bypass authentication mechanism, escalate the
privileges toadministrator level and also made to reveal system
specific information.

Description:
User supplied credential inputs (‘$username’ and ‘$passwd’) are not
sanitized in login.php before subjecting them to SQL query.

<——————-login.php snippet—————————–>

if (isset($_POST['username'])) {
$username=$_POST['username'];
} else $username=”";

$result = mysql_query( “SELECT user FROM “.USER_TBL.” WHERE user=
‘$username’ AND password=’$passwd’” ) or error( mysql_error() );

<—————————————————————–>

This can be exploited in multiple ways,
1. Authentication Bypass
A malicious user can log on to the weblog system without submitting
thepassword by placing queries such as this “admin’ OR ‘x’='x” in
the User Name field.

2. Privilege Escalation.
When a non-administrative user submits, for example “user1′ OR ‘x’='x”
into the User Name field, administrative privileges will be granted.

3. Path Disclosure.
Path information can be made to disclose in error pages by passing
invalid query to User Name field of login.php.

Impact:
Successful exploitation can result in a compromise of the application,
disclosure of system specific information, or permit an attacker to
exploit vulnerabilities in the underlying database implementation.
An attacker can also exploit this vulnerability to elevate privileges
within the affected system.

Affected Systems:
myBloggie 2.1.3-beta and prior.
Linux (Any), Unix (Any), Windows (Any)

Exploit:
1. POST http://example.com/mybloggie/login.php?username=admin’ OR
‘x’='x
2. POST http://example.com/mybloggie/login.php?username=normal_user
‘ OR ‘one’='one
3. POST http://example.com/mybloggie/login.php?username=’1=1 –

Solution:
Patch: http://mywebland.com/forums/showtopic.php?t=399

Reference:
http://marc.theaimsgroup.com/?l=bugtraq&m=112607358831963&w=2

My Blog

Welcome to my blog, guys !!!

This blog is a renovation of http://rahulmohandas.blogspot.com, its here to keep track of my interests in the security space…

Have a nice time….

Disclaimer: This is a personal blog written, edited, and published by and reflects the personal views of me, in my individual capacity. The views and opinions expressed here represent my own and not those of the people, institutions, or organizations that I may or may not be related with, unless stated explicitly.