bugtraq - PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Jul 2006 18:36:36 -0000
From: paisterist.nst@...il.com
To: bugtraq@...urityfocus.com
Subject: PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities


/*
--------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06
--------------------------------------------------------
Program: PBL Guestbook
Homepage: www.pixelatedbylev.com
Vulnerable Versions: 1.32 and lower.
Risk: High!
Impact: Critical Risk

-==PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities==-
---------------------------------------------------------

- Description
---------------------------------------------------------
PBL Guestbook fully functional guestbook loaded with tons of features and packed for premium optimization and performance.

- Tested
---------------------------------------------------------
PBL Homepage & other sites

- Explotation
---------------------------------------------------------

1)

Vulnerable code:


==[ pblguestbook.php 164-183 ]==========================
[...]
if ($id){
foreach ($_POST as $name => $value)
	{
	$_POST["$name"] = str_replace("\n","<BR>",$value);
	 }
foreach ($_POST as $name => $value)
	{
	$_POST["$name"] = str_replace("\t","",$value);
	}
foreach ($_POST as $name => $value)
	{
	$_POST["$name"] = str_replace("\r","",$value);
	}
foreach ($_POST as $name => $value)
	{
	$_POST["$name"] = str_replace('|',"&#166;",$value);
	}
foreach ($_POST as $name => $value)
	{
	$_POST["$name"] = preg_replace("/\<SCRIPT(.*?)\>(.*?)\<\/SCRIPT(.*?)\>/i", "SCRIPT BLOCKED", $value);
	}
[...]	
==[ end pblguestbook.php ]==========================

How we can see the script only do some replaces. Only the <script> tag is filtered, but we can include javascript code with 
other tags.

Here you have some values for the name, message, website and e-mail.

PoC:
---------------------------------------------------------

value: <a onMouseOver="javascript: location.href='http://google.com';" href="#"><h1>TOUCH ME</h1></a>
value: <iframe src="http://somesite.com"></iframe> 

2)

The PBL Guestbook don't use MySQL databases to save the admin info, so it's no very useful give many importance. However, p.e.
 in the next code there's no simple quotes filtering ('). The used variables are the same that we saw in the pasted code:

==[ pblguestbook.php 220-224 ]==========================
[...]
$query = "INSERT INTO `pblguestbook_posts` (`name`,`email`,`ip`,`time`,`website`,`customq1`,`customq2`,";
$query .= "`customq3`,`customq4`,`customq5`,`rate`,`comments`,`private`,`app`) VALUES('$_POST[name]',";
$query .= "'$_POST[email]','$_SERVER[REMOTE_ADDR]','$time','$_POST[website]',";
$query .= "'$conqd1','$conqd2','$conqd3','$conqd4','$conqd5',";
$query .= "'$_POST[rate]','$_POST[comments]','$_POST[private]','$appmode')"
[...]
==[ end pblguestbook.php ]==========================

If magic_quotes_gpc is off, just add one simple quote at the final of the name, email, web or message and you'll see that the
 script can add the post because there was a problem with the sql query.

- How to fix it? More information?
--------------------------------------------------------
Visit our forum to know how to fix it or to get more information.
http://www.neosecurityteam.net/foro/

- References
--------------------------------------------------------
http://www.neosecurityteam.net/index.php?action=advisories&id=23

- Credits
--------------------------------------------------------
Discovered by Paisterist -> paisterist.nst [at] gmail [dot] com

[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/


- Greets
--------------------------------------------------------
HaCkZaTaN
K4P0
Daemon21
Link
LINUX
m0rpheus

Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@ @@@'''''@@@
'@@'''@@@@'''''''''@@@''''@@@
@@@@''''@@'@@@@@@@@@@''''@@@@@

/* EOF */