[Full-disclosure] Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities

2006-10-12T00:00:00
ID SECURITYVULNS:DOC:14647
Type securityvulns
Reporter Securityvulns
Modified 2006-10-12T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

  Advisory: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities

Release Date: 10/12/2006 Last Modified: 10/12/2006 Author: Tamriel [tamriel at gmx dot net] Application: Xeobook <= 0.93 Risk: Moderate Vendor Status: not contacted Vendor Site: www.xeoman.com | www.xeoman.de

Overview:

Quote from www.xeoman.de:

"Xeobook is a highly customizable, easy to setup, secure guestbook script based on PHP4 and MySQL. If you like a clean and fully customizable layout this might be worth a try."

  There are some SQL injection vulnerabilities which can be
  exploited by malicious people to conduct SQL injection attacks.

  The vulnerability has been discovered in the latest version,
  0.93. Other versions may also be affected.

Details:

  Multiple SQL Injections in sign.php

  Input passed to the most parameters aren&#39;t properly sanitised
  before they are used in a SQL query.

  The best examples which an attacker could be use are
  &#96;$HTTP_USER_AGENT&#96; and &#96;$gb_entry_text&#96;.

  All other variables are affected too but they are shorted by
  the scripts &#96;format_wordlength&#96; function.

  The other variables are &#96;$gb_location&#96;, &#96;$gb_fullname&#96; and
  &#96;$gb_sex&#96;.

Proof of Concept:

  Put &#96;/*&#96; into the &#96;$gb_entry_text&#96; variable

Notes:

  rjonesx has already discovered a vulnerability in Xeobook,
  which can be exploited to perform script insertion attacks.
  Because there is no released patch or something similar yet,
  I will not contact the vendor. To fix all these bugs you
  could write the complete guestbook new.

Solution/Fix:

  You must have register_globals enabled to run this script,
  disable it and edit the source code to ensure that input is
  properly sanitised and change all input variables.

  Use functions like PHP&#39;s htmlentities&#40;&#41; and
  mysql_real_escape_string&#40;&#41; functions.

Disclosure Timeline:

  10/12/2006 - Discovery of the vulnerabilities
  10/12/2006 - Public disclosure

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32)

iD8DBQFFLbSlqBhP+Twks7oRCh7CAJwNUgT5OwDcgwj/1YTY58hw6sumrgCcC0/D 6/DRyVO8YVSvKsFKvtoK5gY= =yNlp -----END PGP SIGNATURE-----


Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/