<<< Date Index >>>     <<< Thread Index >>>

Advanced Guestbook 2.2 -- SQL Injection Exploit




The widely-used Advanced Guestbook 2.2 webapplication (PHP, MySQL) appears 
vulnerable to SQL Injection granting the attacker administrator access. The 
attack is very simple and consists of inputting the following password string 
leaving the username entry blank:

') OR ('a' = 'a

Regards,

JQ