TUCoPS :: Web :: CMS / Portals :: bx1471.htm

blogcms 4.2.1b Multiple Security Vulnerabilities ]
blogcms 4.2.1b Multiple Security Vulnerabilities
blogcms 4.2.1b Multiple Security Vulnerabilities

Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-003

Application:                    Blogcms
Versions Affected:              Blogcms 4.2.1b
Vendor URL: http://blogcms.com/ 
Bugs:                           SQL Injestions, SiXSS, XSS
Exploits:                       YES
Reported:                       15.01.2008
Vendor response:                16.01.2008
Date of Public Advisory:        16.01.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Reasearch Group [DSecRG] (research [at] dsec [dot] ru)


Blogcms system has multiple security vulnerabilities:

1. Multiple SQL Injections
2. Multiple Linked XSS
3. Multiple Linked SiXSS


1. Multiple  SQL Injection vulnerabilities

1.1 Attacker can inject SQL code in index.php. Parameter name "blogid"



1.2 Attacker can inject SQL code in module /blogcms/action.php. POST parameter name "user"


POST /blogcms/action.php HTTP/1.0
Cookie: DokuWiki=g8m41hncjkfjkc4sb1lvmgbiu5
Content-Length: 139
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; DS; .NET CLR 2.0.50727)
Pragma: no-cache
Connection: Keep-Alive



2. Multiple Linked XSS vulnerabilities

Linked XSS vulnerability found in  /photo/admin.php and /photo/index.php  attacker can inject XSS script in URL




3. Multiple SiXSS (XSS throught SQl Injection Error) vulnerabilities

3.1 Linked SiXSS vulnerability found in index.php, attacker can inject XSS code in SQL Error 



3.1 Linked SiXSS vulnerability found in /admin/plugins/table/index.php, attacker can inject XSS code in SQL Error 

It is also a SQL injection but because it is in admin panel it is not critical.




Fix Information

Blogcms was altered to fix this flaw on 16.01.2008. Updated version (4.2.1.c) can be downloaded here:

Changelog: http://blogcms.com/wiki/changelog 


Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.

Contact:        research [at] dsec [dot] ru
http://www.dsec.ru (in Russian) 

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986- AOH