Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Advisory: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities
Release Date: 10/12/2006
Last Modified: 10/12/2006
Author: Tamriel [tamriel at gmx dot net]
Application: Xeobook <= 0.93
Risk: Moderate
Vendor Status: not contacted
Vendor Site: www.xeoman.com | www.xeoman.de
Overview:
Quote from www.xeoman.de:
"Xeobook is a highly customizable, easy to setup, secure guestbook
script based on PHP4 and MySQL. If you like a clean and fully
customizable layout this might be worth a try."
There are some SQL injection vulnerabilities which can be
exploited by malicious people to conduct SQL injection attacks.
The vulnerability has been discovered in the latest version,
0.93. Other versions may also be affected.
Details:
Multiple SQL Injections in sign.php
Input passed to the most parameters aren't properly sanitised
before they are used in a SQL query.
The best examples which an attacker could be use are
`$HTTP_USER_AGENT` and `$gb_entry_text`.
All other variables are affected too but they are shorted by
the scripts `format_wordlength` function.
The other variables are `$gb_location`, `$gb_fullname` and
`$gb_sex`.
Proof of Concept:
Put `/*` into the `$gb_entry_text` variable
Notes:
rjonesx has already discovered a vulnerability in Xeobook,
which can be exploited to perform script insertion attacks.
Because there is no released patch or something similar yet,
I will not contact the vendor. To fix all these bugs you
could write the complete guestbook new.
Solution/Fix:
You must have register_globals enabled to run this script,
disable it and edit the source code to ensure that input is
properly sanitised and change all input variables.
Use functions like PHP's htmlentities() and
mysql_real_escape_string() functions.
Disclosure Timeline:
10/12/2006 - Discovery of the vulnerabilities
10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
iD8DBQFFLbSlqBhP+Twks7oRCh7CAJwNUgT5OwDcgwj/1YTY58hw6sumrgCcC0/D
6/DRyVO8YVSvKsFKvtoK5gY=
=yNlp
-----END PGP SIGNATURE-----