[ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability
Author : M.Hasran Addahroni
Date : July, 14 th 2008
Location : Jakarta, Indonesia
Web : http://e-rdc.org/v1/news.php?readmore=102
Critical Lvl : Medium
Impact : System access
Where : From Remote
---------------------------------------------------------------------------
Application : Comdev Web Blogger
version : <= 4.1.3
Vendor : http://www.comdevweb.com/blogger.php
Description :
Comdev Web Blogger is your voice and also allows others to give you feedback on a post-by-post basis.
Site members can now create, manage, upload photos to their own blogs.FEATURES: Non Template-Based Gives You Flexibility to Fit
the Web Blogger to Your Web Design Page Multiple user accounts to create & invite friends to their own blogs Hot Blogs,
Latest Blogs RSS News Feeds Blogs Categorisation Hot Blogs & Latest Blogs Search Blogs Mini Calendar Monthly Archive
Links to Friends' Blog Public or Friends View Only Blogs Set Post Comments Permission Friends Login Forms Submission with
CAPTCHA Image Verification WYSIWYG Editor for Blog & Comment Notify Friends of New Blog Set View & Post Comment Permissions
sSet Date & Time Format Local Time Zone Pre-defined Front-end CSS Personalized Emails & Auto-Responders
Installation Support available
Input passed to the "arcmonth" parameter in blog's page is not properly verified before being used
in an sql query.
This can be exploited thru the browser to manipulate SQL queries and pull the username and password
from admin and users in plain text. Successful exploitation requires that "magic_quotes" is off.
.
