xueBookSQL.txt

`------------------------------------------------------  
Nightmare TeAmZ Advisory 003  
------------------------------------------------------  
Date - 11/2005  
xueBook 1.0 Sql Injection  
  
  
AFFECTED PRODUCTS  
=================  
xueBook 1.0 Guestbook  
http://www.maidensoul.net/wp-content/goodies/xuebook/readme.html  
  
  
OVERVIEW  
========  
xueBook is an open-source guestbook script that is free to download, use,   
and modify so long as credit is given to Tiffany Zhou for the production of   
the original script. It would be nice, also, to put include a link to   
xueBook on your website if you choose to use this script.  
  
  
DETAILS  
=======  
  
1. Sql Injection  
  
An unauthenticated attacker may execute arbitrary SQL statements on the   
vulnerable system. This may compromise the integrity of your database and   
expose sensitive information.  
  
POC  
===  
  
1.  
------  
Sql Injecion:  
  
Exemple  
--------  
Vulnerable Path:  
CODE  
  
/index.php?start=[SQL]  
  
Exemple:  
  
http://www.[host].net/[Path]/index.php?start=[SQL]  
  
Credits  
=======  
This vulnerability was discovered and researched by  
BiPi_HaCk, Advisory by Sub_Z3r0 of Nightmare TeAmZ,  
  
Site: http://www.NightmareTeAmZ.altervista.org  
  
_________________________________________________________________  
Ricerche online più semplici e veloci con MSN Toolbar!   
http://toolbar.msn.it/  
`