------------------------------------------------------
Nightmare TeAmZ Advisory 003
------------------------------------------------------
Date - 11/2005
xueBook 1.0 Sql Injection


AFFECTED PRODUCTS
=================
xueBook 1.0 Guestbook
http://www.maidensoul.net/wp-content/goodies/xuebook/readme.html


OVERVIEW
========
xueBook is an open-source guestbook script that is free to download, use, 
and modify so long as credit is given to Tiffany Zhou for the production of 
the original script. It would be nice, also, to put include a link to 
xueBook on your website if you choose to use this script.


DETAILS
=======

1. Sql Injection

An unauthenticated attacker may execute arbitrary SQL statements on the 
vulnerable system. This may compromise the integrity of your database and 
expose sensitive information.

POC
===

1.
------
Sql Injecion:

Exemple
--------
Vulnerable Path:
CODE

/index.php?start=[SQL]

Exemple:

http://www.[host].net/[Path]/index.php?start=[SQL]

Credits
=======
This vulnerability was discovered and researched by
BiPi_HaCk, Advisory by Sub_Z3r0 of Nightmare TeAmZ,

Site: http://www.NightmareTeAmZ.altervista.org

_________________________________________________________________
Ricerche online pił semplici e veloci con MSN Toolbar! 
http://toolbar.msn.it/