exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Easy Blog XSS / SQL Injection / Shell Upload

Easy Blog XSS / SQL Injection / Shell Upload
Posted Jul 24, 2013
Authored by Sp3ctrecore

Easy Blog from JM LLC suffers from cross site scripting, remote shell upload, and remote SQL injection vulnerabilities.

tags | exploit, remote, shell, vulnerability, xss, sql injection
SHA-256 | 92e6510e14c604e95a17cc5ed18c985111677ae10b2de17eea7ab41b69bcd495

Easy Blog XSS / SQL Injection / Shell Upload

Change Mirror Download
########## ADVISORY ##########


==============================================
Easy Blog by JM LLC - Multiple Vulnerabilities
==============================================

Software................: Easy Blog
Software link...........: http://www.jmagness.com/download/Easy_Blog.zip
Vendor..................: JM LLC
Vendor homepage.........: http://www.jmagness.com

Exploit author..........: Sp3ctrecore
Contact.................: sp3ctrecore[at]gmail[dot]com


--------
OVERVIEW
--------

Easy Blog is affected by multiple vulnerabilities.


-------------------
DISCLOSURE TIMELINE
-------------------

04/07/2013 -- Multiple vulnerabilities discovered and reported to the vendor.
19/07/2013 -- The vendor confirmed the vulnerabilities, but has no
time to fix them.
24/07/2013 -- Public disclosure.


---------------
VULNERABILITIES
---------------

[01] SHELL UPLOAD

The image upload function in add.php allows unrestricted file upload.
An attacker may upload a shell gaining unauthorized access to the
system.


[02] MULTIPLE SQL INJECTIONS

I. add.php - filename parameter (POST request)
An attacker may upload a file with a crafted name (e.g.
"file.txt',(select version()))-- -") injecting SQL code.
The content is readable in the homepage.

II. edit.php - filename parameter (POST request)
An attacker may upload a file with a crafted name (e.g.
"file.txt',POST=(select version()) WHERE id=1-- -") injecting SQL
code.
The content is readable in the homepage.


[03] MULTIPLE CROSS-SITE SCRIPTING

I. add.php - title parameter (POST request): stored XSS.
II. add.php - keywords parameter (POST request): stored XSS.
III. add.php - description parameter (POST request): stored XSS.
IV. add.php - slug parameter (POST request): reflected XSS.
Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close