myBloggie 2.1.6 SQL Injection and Persistent XSS

2011-06-1

Information

Software: myBloggie 2.1.6
Severity: High
Author: Robin Verton Date: Jun. 12 2011
Vendor: http://mybloggie.mywebland.com/

Software Description

"myBloggie is considered one of the most simple, user-friendliest yet packed with features Weblog system available to date."

Issue details

myBloggie 2.1.6 is - again - prone to a SQL-Injection vulnerability in the trackback function. It is possible to add a malformed URL to a trackback so malicious code can be injected to insert/read out data from the database.

An unsafe regular expression which does not properly check the passed trackback-url can be bypassed to inject malicious data into an INSERT INTO statement, resulting in an persistent cross-site-scripting or be used for reading out sensitive data (see 'Advanced INSERT INTO exploitation by taking advantage of the primary key' described here [1]).

Technical details

// php trachback.php - line 33-35
$url=urldecode($_REQUEST['url']);
if (validate_url($url)==false) { $tback->trackback_reply(1, "<p>Sorry, Trackback failed.. Reason : URL not valid</p>"); }
//php functions.php - line 750
function validate_url($url) {
    if ( ! preg_match('#^http\\:\\/\\/[a-z0-9\-]+\.([a-z0-9\-]+\.)?[a-z]+#i', $url, $matches) ) {
        return false;
    } else {
        return true;  
    }
} 

As you can see the end of the passed $url in the regular expression is not defined. By providing an URL like

http://example.com'INJECTION

the validation can be bypassed.

Timeline

Jul 12 2011 - Bug found.
Jul 12 2011 - Vendor contacted.
Jul 15 2011 - Full disclosure.