xueBook guestbook version 1.0 is susceptible to SQL injection attacks.
4891c977ef261794e46acefca0cf324c3bd7969475a8b494b51f8dfa4584a2fa
------------------------------------------------------
Nightmare TeAmZ Advisory 003
------------------------------------------------------
Date - 11/2005
xueBook 1.0 Sql Injection
AFFECTED PRODUCTS
=================
xueBook 1.0 Guestbook
https://www.maidensoul.net/wp-content/goodies/xuebook/readme.html
OVERVIEW
========
xueBook is an open-source guestbook script that is free to download, use,
and modify so long as credit is given to Tiffany Zhou for the production of
the original script. It would be nice, also, to put include a link to
xueBook on your website if you choose to use this script.
DETAILS
=======
1. Sql Injection
An unauthenticated attacker may execute arbitrary SQL statements on the
vulnerable system. This may compromise the integrity of your database and
expose sensitive information.
POC
===
1.
------
Sql Injecion:
Exemple
--------
Vulnerable Path:
CODE
/index.php?start=[SQL]
Exemple:
https://www.[host].net/[Path]/index.php?start=[SQL]
Credits
=======
This vulnerability was discovered and researched by
BiPi_HaCk, Advisory by Sub_Z3r0 of Nightmare TeAmZ,
Site: https://www.NightmareTeAmZ.altervista.org
_________________________________________________________________
Ricerche online piĆ¹ semplici e veloci con MSN Toolbar!
https://toolbar.msn.it/