PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities

[paisterist.nst () gmail com]

/*
--------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06
--------------------------------------------------------
Program: PBL Guestbook
Homepage: www.pixelatedbylev.com
Vulnerable Versions: 1.32 and lower.
Risk: High!
Impact: Critical Risk

-==PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities==-
---------------------------------------------------------

- Description
---------------------------------------------------------
PBL Guestbook fully functional guestbook loaded with tons of features and packed for premium optimization and 
performance.

- Tested
---------------------------------------------------------
PBL Homepage & other sites

- Explotation
---------------------------------------------------------

1)

Vulnerable code:


==[ pblguestbook.php 164-183 ]==========================
[...]
if ($id){
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace("\n","<BR>",$value);
         }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace("\t","",$value);
        }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace("\r","",$value);
        }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = str_replace('|',"&#166;",$value);
        }
foreach ($_POST as $name => $value)
        {
        $_POST["$name"] = preg_replace("/\<SCRIPT(.*?)\>(.*?)\<\/SCRIPT(.*?)\>/i", "SCRIPT BLOCKED", $value);
        }
[...]   
==[ end pblguestbook.php ]==========================

How we can see the script only do some replaces. Only the <script> tag is filtered, but we can include javascript code 
with 
other tags.

Here you have some values for the name, message, website and e-mail.

PoC:
---------------------------------------------------------

value: <a onMouseOver="javascript: location.href='http://google.com';"; href="#"><h1>TOUCH ME</h1></a>
value: <iframe src="http://somesite.com";></iframe> 

2)

The PBL Guestbook don't use MySQL databases to save the admin info, so it's no very useful give many importance. 
However, p.e.
 in the next code there's no simple quotes filtering ('). The used variables are the same that we saw in the pasted 
code:

==[ pblguestbook.php 220-224 ]==========================
[...]
$query = "INSERT INTO `pblguestbook_posts` (`name`,`email`,`ip`,`time`,`website`,`customq1`,`customq2`,";
$query .= "`customq3`,`customq4`,`customq5`,`rate`,`comments`,`private`,`app`) VALUES('$_POST[name]',";
$query .= "'$_POST[email]','$_SERVER[REMOTE_ADDR]','$time','$_POST[website]',";
$query .= "'$conqd1','$conqd2','$conqd3','$conqd4','$conqd5',";
$query .= "'$_POST[rate]','$_POST[comments]','$_POST[private]','$appmode')"
[...]
==[ end pblguestbook.php ]==========================

If magic_quotes_gpc is off, just add one simple quote at the final of the name, email, web or message and you'll see 
that the
 script can add the post because there was a problem with the sql query.

- How to fix it? More information?
--------------------------------------------------------
Visit our forum to know how to fix it or to get more information.
http://www.neosecurityteam.net/foro/

- References
--------------------------------------------------------
http://www.neosecurityteam.net/index.php?action=advisories&id=23

- Credits
--------------------------------------------------------
Discovered by Paisterist -> paisterist.nst [at] gmail [dot] com

[N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/


- Greets
--------------------------------------------------------
HaCkZaTaN
K4P0
Daemon21
Link
LINUX
m0rpheus

Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!!

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@ @@@'''''@@@
'@@'''@@@@'''''''''@@@''''@@@
@@@@''''@@'@@@@@@@@@@''''@@@@@

/* EOF */