myBloggie 2.1.6 SQL-Injection, Advanced INSERT INTO Injection technique
Software: myBloggie 2.1.6
Severity: High
Author: Robin Verton <info (at) robinverton (dot) de>
Date: Jun. 12 2011
Vendor: http://mybloggie.mywebland.com/
Software Description:
"myBloggie is considered one of the most simple, user-friendliest yet packed
with features Weblog system available to date."
Issue details:
myBloggie 2.1.6 is - again - prone to a SQL-Injection vulnerability in the
trackback function. It is possible to add a malformed URL to a trackback so
malicious code can be injected to insert/read out data from the database.
An unsafe regular expression which does not properly check the passed
trackback-url can be bypassed to inject malicious data into an INSERT INTO
statement, resulting in an persistent cross-site-scripting or be used for
reading out sensitive data (see 'Advanced INSERT INTO exploitation by taking
advantage of the primary key' described here [1]).
Technical details:
trackback.php - Line 33-35
$url=urldecode($_REQUEST['url']);
if (validate_url($url)==false) { $tback->trackback_reply(1, "<p>Sorry,
Trackback failed.. Reason : URL not valid</p>"); }
function.php - Line 750-755
function validate_url($url) {
if ( ! preg_match('#^http\\:\\/\\/[a-z0-9\-]+\.([a-z0-9\-]+\.)?[a-z]+#i',
$url, $matches) ) {
return false ;}
else {
return true; }
}
As you can see the end of the passed $url in the regular expression is not
defined. By providing an URL like http://example.com'INJECTION the filter can
be bypassed.
Timeline:
12. July 2011 - Bug found.
12. July 2011 - Vendor contacted.
15. July 2011 - Full disclosure.
References:
[0] Original advisory:
http://robinverton.de/blog/mybloggie-2-1-6-sql-injection-persistent-xss
[1]
http://robinverton.de/blog/advanced-insert-into-injection-by-taking-advantage-of-the-primary-key
