OpenGuestbook version 0.5 is susceptible to cross site scripting and SQL injection flaws.
2b065c9e0bddbe8487358e0a491f3ed4ca8a65459d9c3c6c969db4f9b80362f0Produce : Open Guestbook 0.5
Site : http://sourceforge.net/projects/openguestbook
Discovred by: Moroccan Security Team (Simo64)
Greetz to : And All Friends :)
Details :
=========
[+]Cross Site Scripting
************************
[-]vulnerable code in header.php on line 5
[1] <html>
[2]
[3] <head>
[4]
[5] <title><? echo "$title"; ?></title>
--------------------
Exploit : http://localhost/openguestbook/header.php?title=</title>[XSS]
[-] Solution
edit line 5 on header.php
[5] <title><? echo htmlspecialchars($title); ?></title>
[+]SQL Injection
******************
[-]vulnerable code near lines 23 - 28
[23] if (empty($offset)) {
[24] $offset=0;
[25] }
[26]
[27] // get results
[28] $result=mysql_query("SELECT * FROM $tentries ORDER BY ID DESC limit $offset,$limit");
[-]Exploit : http://localhost/openguestbook/view.php?offset=[SQL]
[-]Solution :
edit line 23 in view.php
[23] if (empty($offset) OR !is_numeric($offset) {
[24] $offset=0;
[+] Contact :
**************
simo64[at]gmail[dot]com
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed