/*

--------------------------------------------------------

[N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06

--------------------------------------------------------

Program: PBL Guestbook

Homepage: www.pixelatedbylev.com

Vulnerable Versions: 1.32 and lower.

Risk: High!

Impact: Critical Risk

-==PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities==-

---------------------------------------------------------

- Description

---------------------------------------------------------

PBL Guestbook fully functional guestbook loaded with tons of features and packed for premium optimization and performance.

- Tested

---------------------------------------------------------

PBL Homepage & other sites

- Explotation

---------------------------------------------------------

1)

Vulnerable code:

==[ pblguestbook.php 164-183 ]==========================

[...]

if ($id){

foreach ($_POST as $name => $value)

{

$_POST["$name"] = str_replace("\n","<BR>",$value);

}

foreach ($_POST as $name => $value)

{

$_POST["$name"] = str_replace("\t","",$value);

}

foreach ($_POST as $name => $value)

{

$_POST["$name"] = str_replace("\r","",$value);

}

foreach ($_POST as $name => $value)

{

$_POST["$name"] = str_replace('|',"¦",$value);

}

foreach ($_POST as $name => $value)

{

$_POST["$name"] = preg_replace("/\<SCRIPT(.*?)\>(.*?)\<\/SCRIPT(.*?)\>/i", "SCRIPT BLOCKED", $value);

}

[...]

==[ end pblguestbook.php ]==========================

How we can see the script only do some replaces. Only the <script> tag is filtered, but we can include javascript code with

other tags.

Here you have some values for the name, message, website and e-mail.

PoC:

---------------------------------------------------------

value: <a onMouseOver="javascript: location.href='http://google.com';" href="#"><h1>TOUCH ME</h1></a>

value: <iframe src="http://somesite.com"></iframe>

2)

The PBL Guestbook don't use MySQL databases to save the admin info, so it's no very useful give many importance. However, p.e.

in the next code there's no simple quotes filtering ('). The used variables are the same that we saw in the pasted code:

==[ pblguestbook.php 220-224 ]==========================

[...]

$query = "INSERT INTO `pblguestbook_posts` (`name`,`email`,`ip`,`time`,`website`,`customq1`,`customq2`,";

$query .= "`customq3`,`customq4`,`customq5`,`rate`,`comments`,`private`,`app`) VALUES('$_POST[name]',";

$query .= "'$_POST[email]','$_SERVER[REMOTE_ADDR]','$time','$_POST[website]',";

$query .= "'$conqd1','$conqd2','$conqd3','$conqd4','$conqd5',";

$query .= "'$_POST[rate]','$_POST[comments]','$_POST[private]','$appmode')"

[...]

==[ end pblguestbook.php ]==========================

If magic_quotes_gpc is off, just add one simple quote at the final of the name, email, web or message and you'll see that the

script can add the post because there was a problem with the sql query.

- How to fix it? More information?

--------------------------------------------------------

Visit our forum to know how to fix it or to get more information.

http://www.neosecurityteam.net/foro/

- References

--------------------------------------------------------

http://www.neosecurityteam.net/index.php?action=advisories&id=23

- Credits

--------------------------------------------------------

Discovered by Paisterist -> paisterist.nst [at] gmail [dot] com

[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/

- Greets

--------------------------------------------------------

HaCkZaTaN

K4P0

Daemon21

Link

LINUX

m0rpheus

Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@

'@@@@@''@@'@@@''''''''@@''@@@''@@

'@@'@@@@@@''@@@@@@ @@@'''''@@@

'@@'''@@@@'''''''''@@@''''@@@

@@@@''''@@'@@@@@@@@@@''''@@@@@

/* EOF */

[ reply ]