Информационная безопасность
[RU] switch to English


Дополнительная информация

  Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  zenphoto Multiple Path Disclosure and Cross Site Scripting Vulnerabilities

  [email protected] <= 3.1.9e (naboard_pnr.
php) Remote File Include Vulnerability

  Exploits Minichat v6 Remote File Include

  SH-News (RFI)

From:tamriel_(at)_gmx.net <tamriel_(at)_gmx.net>
Date:12 октября 2006 г.
Subject:[Full-disclosure] Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

     Advisory: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities
 Release Date: 10/12/2006
Last Modified: 10/12/2006
       Author: Tamriel [tamriel at gmx dot net]
  Application: Xeobook <= 0.93
         Risk: Moderate
Vendor Status: not contacted
  Vendor Site: www.xeoman.com | www.xeoman.de


Overview:

  Quote from www.xeoman.de:

 "Xeobook is a highly customizable, easy to setup, secure guestbook
  script based on PHP4 and MySQL. If you like a clean and fully
  customizable layout this might be worth a try."

     There are some SQL injection vulnerabilities which can be
     exploited by malicious people to conduct SQL injection attacks.

     The vulnerability has been discovered in the latest version,
     0.93. Other versions may also be affected.


Details:

     Multiple SQL Injections in sign.php

     Input passed to the most parameters aren't properly sanitised
     before they are used in a SQL query.

     The best examples which an attacker could be use are
     `$HTTP_USER_AGENT` and `$gb_entry_text`.

     All other variables are affected too but they are shorted by
     the scripts `format_wordlength` function.

     The other variables are `$gb_location`, `$gb_fullname` and
     `$gb_sex`.


Proof of Concept:

     Put `/*` into the `$gb_entry_text` variable


Notes:

     rjonesx has already discovered a vulnerability in Xeobook,
     which can be exploited to perform script insertion attacks.
     Because there is no released patch or something similar yet,
     I will not contact the vendor. To fix all these bugs you
     could write the complete guestbook new.


Solution/Fix:

     You must have register_globals enabled to run this script,
     disable it and edit the source code to ensure that input is
     properly sanitised and change all input variables.

     Use functions like PHP's htmlentities() and
     mysql_real_escape_string() functions.


Disclosure Timeline:

     10/12/2006 - Discovery of the vulnerabilities
     10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFLbSlqBhP+Twks7oRCh7CAJwNUgT5OwDcgwj/1YTY58hw6sumrgCcC0/D
6/DRyVO8YVSvKsFKvtoK5gY=
=yNlp
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород