CVE-2008-0424

The CVE-2008-0424 entry concerns Mooseguy Blog System (MGBS) 1.0. The vulnerability is a SQL injection in blog.php caused by input via the month parameter, enabling remote attackers to execute arbitrary SQL commands. Affected software is MGBS 1.0; the exact root cause is an unsafely handled month...

mgbs-sql.txt

MGBS 1.0 Remote SQL injection Script url http://sourceforge.net/project/showfiles.php?groupid=193233 Vulnerable code in blog.php ?php $month = $GET'month'; $result = mysqlquery"SELECT FROM blog WHERE posted='$month' ORDER BY id DESC" or die"HELP QUERY BROKEN"; ... Admin hash exploit...

Mooseguy Blog System 1.0 - 'month' SQL Injection

MGBS 1.0 Remote SQL injection Script url http://sourceforge.net/project/showfiles.php?groupid=193233 Vulnerable code in blog.php ?php $month = $GET'month'; $result = mysqlquery"SELECT FROM blog WHERE posted='$month' ORDER BY id DESC" or die"HELP QUERY BROKEN"; ... Admin hash exploit...