TITLE:
Simplog Multiple Vulnerabilities and Security Issues

SECUNIA ADVISORY ID:
SA19628

VERIFY ADVISORY:
http://secunia.com/advisories/19628/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data, Exposure
of system information, System access

WHERE:
>From remote

SOFTWARE:
Simplog 0.x
http://secunia.com/product/5750/

DESCRIPTION:
Some vulnerabilities and security issues have been discovered in
Simplog, which can be exploited by malicious people to disclose
system information, conduct cross-site scripting and SQL injection
attacks, execute arbitrary SQL code, and compromise a vulnerable
system.

1) Input passed to the "s" parameter in "doc/index.php" isn't
properly verified, before it is used to include files. This can be
exploited to include arbitrary files from external and local
resources.

2) Input passed to the "blogid" parameter in "index.php", and the
"blogid", "m", and "y" parameters in "archive.php" isn't properly
sanitised before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

3) The problem is caused due to the presence of the insecure test
scripts "adodb/server.php" and "adodb/tests/tmssql.php". This can be
exploited to execute arbitrary SQL code or call an arbitrary PHP
function.

For more information:
SA17418

4) Input passed to the "btag" parameter in "login.php" isn't properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

The vulnerabilities and the security issues have been confirmed in
version 0.9.2. Other versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised and
verified, and restrict web access to the "adodb" directory.

PROVIDED AND/OR DISCOVERED BY:
1, 2, 4) rgod
3) Originally discovered in ADOdb by Andreas Sandblad, Secunia
Research, and reported in Simplog by rgod.

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/1663

OTHER REFERENCES:
SA17418:
http://secunia.com/advisories/17418/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------