bugtraq - sBlog SQL Injection and Path Disclosure Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060502111612.2683.qmail@securityfocus.com>
Date: 2 May 2006 11:16:12 -0000
From: admin@...jectzero.net
To: bugtraq@...urityfocus.com
Subject: sBlog SQL Injection and Path Disclosure Vulnerability

Summary:
Software: sBlog 0.7.2
Site: http://servous.se/
Description: sBlog is a simple and new PHP Blog. 

Issue: Conducting a security benchmark on this open source software we have found that most of the versions of this software is prone to SQL Injection attack through which an attacker can trigger back sensitive information as well as gain administrative priviledges. The sql injection also discloses path information which may prove additional aid to the attacker.An unauthenticated attacker may execute arbitrary SQL statements on the web. This may compromise the database and expose sensitive information.

========================================

PROOF OF CONCEPT  : http://www.subjectzero.net/research/sblog.htm

========================================