PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities

[paisterist.nst@xxxxxxxxx]

/*
--------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06
--------------------------------------------------------
Program: PBL Guestbook
Homepage: www.pixelatedbylev.com
Vulnerable Versions: 1.32 and lower.
Risk: High!
Impact: Critical Risk

-==PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities==-
---------------------------------------------------------

- Description
---------------------------------------------------------
PBL Guestbook fully functional guestbook loaded with tons of features and 
packed for premium optimization and performance.

- Tested
---------------------------------------------------------
PBL Homepage & other sites

- Explotation
---------------------------------------------------------

1)

Vulnerable code:


==[ pblguestbook.php 164-183 ]==========================
[...]
if ($id){
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace("\n","<BR>",$value);
         }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace("\t","",$value);
        }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace("\r","",$value);
        }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace('|',"&#166;",$value);
        }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = 
preg_replace("/\<SCRIPT(.*?)\>(.*?)\<\/SCRIPT(.*?)\>/i", "SCRIPT BLOCKED", 
$value);
        }
[...]   
==[ end pblguestbook.php ]==========================

How we can see the script only do some replaces. Only the <script> tag is 
filtered, but we can include javascript code with 
other tags.

Here you have some values for the name, message, website and e-mail.

PoC:
---------------------------------------------------------

value: <a onMouseOver="javascript: location.href='http://google.com';" 
href="#"><h1>TOUCH ME</h1></a>
value: <iframe src="http://somesite.com";></iframe> 

2)

The PBL Guestbook don't use MySQL databases to save the admin info, so it's no 
very useful give many importance. However, p.e.
 in the next code there's no simple quotes filtering ('). The used variables 
are the same that we saw in the pasted code:

==[ pblguestbook.php 220-224 ]==========================
[...]
$query = "INSERT INTO `pblguestbook_posts` 
(`name`,`email`,`ip`,`time`,`website`,`customq1`,`customq2`,";
$query .= "`customq3`,`customq4`,`customq5`,`rate`,`comments`,`private`,`app`) 
VALUES('$_POST[name]',";
$query .= "'$_POST[email]','$_SERVER[REMOTE_ADDR]','$time','$_POST[website]',";
$query .= "'$conqd1','$conqd2','$conqd3','$conqd4','$conqd5',";
$query .= "'$_POST[rate]','$_POST[comments]','$_POST[private]','$appmode')"
[...]
==[ end pblguestbook.php ]==========================

If magic_quotes_gpc is off, just add one simple quote at the final of the name, 
email, web or message and you'll see that the
 script can add the post because there was a problem with the sql query.

- How to fix it? More information?
--------------------------------------------------------
Visit our forum to know how to fix it or to get more information.
http://www.neosecurityteam.net/foro/

- References
--------------------------------------------------------
http://www.neosecurityteam.net/index.php?action=advisories&id=23

- Credits
--------------------------------------------------------
Discovered by Paisterist -> paisterist.nst [at] gmail [dot] com

[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/


- Greets
--------------------------------------------------------
HaCkZaTaN
K4P0
Daemon21
Link
LINUX
m0rpheus

Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@ @@@'''''@@@
'@@'''@@@@'''''''''@@@''''@@@
@@@@''''@@'@@@@@@@@@@''''@@@@@

/* EOF */