[eVuln.com] Multiple SQL injections in Wernhart Guestbook
New eVuln Advisory:
Multiple SQL injections in Wernhart Guestbook
Summary: http://evuln.com/vulns/149/summary.html
Details: http://evuln.com/vulns/149/description.html
-----------Summary-----------
eVuln ID: EV0149
Software: Wernhart Guestbook
Vendor: Carl A. Wernhart
Version: 2001.03.28
Critical Level: low
Type: SQL Injection
Status: Unpatched. No reply from developer(s)
PoC: Available
Solution: Not available
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )
--------Description--------
Multiple SQL injections:
All user-defined parameters are not sanitized.
Arbitrary SQL injections are possible.
Vulnerable scripts: insert.phtml, select.phtml.
Conditions:
magic_quotes_gpc = Off
register_globals: On
--------PoC/Exploit--------
PoC code is available at:
http://evuln.com/vulns/149/exploit.html
---------Solution----------
Not available
----------Credit-----------
Vulnerability discovered by Aliaksandr Hartsuyeu
http://evuln.com/xss/url.html - recent url xss vulns