Advisory: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities
  Release Date: 10/12/2006
 Last Modified: 10/12/2006
        Author: Tamriel [tamriel at gmx dot net]
   Application: Xeobook <= 0.93
          Risk: Moderate
 Vendor Status: not contacted
   Vendor Site: www.xeoman.com | www.xeoman.de


 Overview:

   Quote from www.xeoman.de:

  "Xeobook is a highly customizable, easy to setup, secure guestbook
   script based on PHP4 and MySQL. If you like a clean and fully
   customizable layout this might be worth a try."

      There are some SQL injection vulnerabilities which can be 
      exploited by malicious people to conduct SQL injection attacks.

      The vulnerability has been discovered in the latest version, 
      0.93. Other versions may also be affected.


 Details:
 
      Multiple SQL Injections in sign.php

      Input passed to the most parameters aren't properly sanitised
      before they are used in a SQL query.

      The best examples which an attacker could be use are 
      `$HTTP_USER_AGENT` and `$gb_entry_text`.

      All other variables are affected too but they are shorted by
      the scripts `format_wordlength` function.

      The other variables are `$gb_location`, `$gb_fullname` and
      `$gb_sex`.


 Proof of Concept:

      Put `/*` into the `$gb_entry_text` variable


 Notes:

      rjonesx has already discovered a vulnerability in Xeobook,
      which can be exploited to perform script insertion attacks.
      Because there is no released patch or something similar yet,
      I will not contact the vendor. To fix all these bugs you
      could write the complete guestbook new.


 Solution/Fix:

      You must have register_globals enabled to run this script,
      disable it and edit the source code to ensure that input is
      properly sanitised and change all input variables.

      Use functions like PHP's htmlentities() and
      mysql_real_escape_string() functions.


 Disclosure Timeline:

      10/12/2006 - Discovery of the vulnerabilities
      10/12/2006 - Public disclosure