bugtraq - Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <452DB4A5.4020504@gmx.net>
Date: Wed, 11 Oct 2006 22:21:09 -0500
From: Tamriel <tamriel@....net>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
 
      Advisory: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities
  Release Date: 10/12/2006
 Last Modified: 10/12/2006
        Author: Tamriel [tamriel at gmx dot net]
   Application: Xeobook <= 0.93
          Risk: Moderate
 Vendor Status: not contacted
   Vendor Site: www.xeoman.com | www.xeoman.de


 Overview:

   Quote from www.xeoman.de:

  "Xeobook is a highly customizable, easy to setup, secure guestbook
   script based on PHP4 and MySQL. If you like a clean and fully
   customizable layout this might be worth a try."

      There are some SQL injection vulnerabilities which can be
      exploited by malicious people to conduct SQL injection attacks.

      The vulnerability has been discovered in the latest version,
      0.93. Other versions may also be affected.


 Details:
 
      Multiple SQL Injections in sign.php

      Input passed to the most parameters aren't properly sanitised
      before they are used in a SQL query.

      The best examples which an attacker could be use are
      `$HTTP_USER_AGENT` and `$gb_entry_text`.

      All other variables are affected too but they are shorted by
      the scripts `format_wordlength` function.

      The other variables are `$gb_location`, `$gb_fullname` and
      `$gb_sex`.


 Proof of Concept:

      Put `/*` into the `$gb_entry_text` variable


 Notes:

      rjonesx has already discovered a vulnerability in Xeobook,
      which can be exploited to perform script insertion attacks.
      Because there is no released patch or something similar yet,
      I will not contact the vendor. To fix all these bugs you
      could write the complete guestbook new.


 Solution/Fix:

      You must have register_globals enabled to run this script,
      disable it and edit the source code to ensure that input is
      properly sanitised and change all input variables.

      Use functions like PHP's htmlentities() and
      mysql_real_escape_string() functions.


 Disclosure Timeline:

      10/12/2006 - Discovery of the vulnerabilities
      10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
 
iD8DBQFFLbSlqBhP+Twks7oRCh7CAJwNUgT5OwDcgwj/1YTY58hw6sumrgCcC0/D
6/DRyVO8YVSvKsFKvtoK5gY=
=yNlp
-----END PGP SIGNATURE-----