TITLE: Leif M. Wright's Blog Multiple Vulnerabilities SECUNIA ADVISORY ID: SA18923 VERIFY ADVISORY: http://secunia.com/advisories/18923/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, Exposure of sensitive information, System access WHERE: >From remote SOFTWARE: Leif M. Wright Web Blog 3.x http://secunia.com/product/8135/ DESCRIPTION: Aliaksandr Hartsuyeu has reported some vulnerabilities in Leif M. Wright's Blog, which can be exploited by malicious people to disclose potentially sensitive information, bypass certain security restrictions, conduct script insertion attacks, and potentially to compromise a vulnerable system. 1) The default installation does not properly restrict access to "txt" files using .htaccess. This can be exploited to retrieve the administrator's password from the configuration file. 2) The "blog.cgi" script does not validate the password submitted via the cookie when validating administrator access. 3) The administrative user is allowed to edit the full path to the "sendmail" program when modifying the blog configuration. This can be exploited to execute arbitrary shell commands and can potentially be exploited in conjunction with vulnerability #1 to compromise a vulnerable system. 4) Input passed in the HTTP_REFERER and HTTP_USER_AGENT HTTP request headers isn't sanitised before being saved. This can be exploited to execute arbitrary HTML and script code in the administrative user's browser session in context of an affected website when the "Log" page is viewed. The vulnerabilities have been reported in version 3.5. Other versions may also be affected. SOLUTION: Edit the source code to ensure that input is properly sanitised and restrict access to the configuration files (e.g. with a .htaccess file). PROVIDED AND/OR DISCOVERED BY: Aliaksandr Hartsuyeu ORIGINAL ADVISORY: http://evuln.com/vulns/82/summary.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------