lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 1 Oct 2007 13:12:40 -0000
From: m2x@...ox.ru
To: bugtraq@...urityfocus.com
Subject: New Advisory:  X-script GuestBook

New Advisory:
X-script GuestBook
http://www.security-news.ws

--------------------Summary----------------
Software: x-script GuestBook
Sowtware's Web Site: http://x-script.net.ru
Versions: 1.3a
Critical Level: Moderate
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched
PoC/Exploit: Not Available
Solution: Not Available
Discovered by: Security-news.ws

-----------------Description---------------
1. SQL Injection.

Vulnerable script: mes_add.php

Parameters 'name', 'email', 'icq', 'website' is not
properly sanitized before being used in SQL query. This can be used to
make SQL queries by injecting arbitrary SQL code.

Condition: magic_quotes_gpc = off

--------------PoC/Exploit----------------------
Waiting for developer(s) reply.

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: security-news.ws

Powered by blists - more mailing lists