----------------------------------------------------------------------

Did you know? Our assessment and impact rating along with detailed
information such as exploit code availability, or if an updated patch
is released by the vendor, is not part of this mailing-list?
        
Click here to learn more about our commercial solutions:
http://secunia.com/advisories/business_solutions/
        
Click here to trial our solutions:
http://secunia.com/advisories/try_vi/

----------------------------------------------------------------------

TITLE:
BlogMan Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA34132

VERIFY ADVISORY:
http://secunia.com/advisories/34132/

DESCRIPTION:
Salvatore "drosophila" Fresta has discovered some vulnerabilities in
BlogMan, which can be exploited by malicious people to conduct SQL
injection attacks or bypass certain security restrictions.

1) Input passed via the "blogmanuserid" cookie parameter in e.g.
index.php, register.php, or viewall.php is not properly sanitised
before being used in an SQL query in core.php. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.

2) Input passed via the "blogmanuserid" cookie parameter in admin.php
is not properly sanitised before being used in an SQL query. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code.

3) Input passed to the "id" parameter in read.php and profile.php is
not properly sanitised before being used in an SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) Input passed to the "un" and "pw" parameters in doLogin.php is not
properly sanitised before being used in an SQL query. This can be
exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation of these vulnerabilities requires that
"magic_quotes_gpc" is disabled.

5) The application allows access to the administration interface by
checking if a certain cookie exists. This can be exploited to gain
administrative access to the application by creating the cookie
"blogmanuserid" and assigning it the value of an existing user, e.g.
"1" for "admin".

The vulnerabilities are reported in version 0.45 and confirmed in
version 0.6.0. Other versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
Salvatore "drosophila" Fresta

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------