-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Advisory: Xeobook <= 0.93 Multiple SQL Injection Vulnerabilities
Release Date: 10/12/2006 Last Modified: 10/12/2006 Author: Tamriel [tamriel at gmx dot net] Application: Xeobook <= 0.93 Risk: Moderate Vendor Status: not contacted Vendor Site: www.xeoman.com | www.xeoman.de
Quote from www.xeoman.de:
"Xeobook is a highly customizable, easy to setup, secure guestbook script based on PHP4 and MySQL. If you like a clean and fully customizable layout this might be worth a try."
There are some SQL injection vulnerabilities which can be exploited by malicious people to conduct SQL injection attacks. The vulnerability has been discovered in the latest version, 0.93. Other versions may also be affected.
Multiple SQL Injections in sign.php Input passed to the most parameters aren't properly sanitised before they are used in a SQL query. The best examples which an attacker could be use are `$HTTP_USER_AGENT` and `$gb_entry_text`. All other variables are affected too but they are shorted by the scripts `format_wordlength` function. The other variables are `$gb_location`, `$gb_fullname` and `$gb_sex`.
Proof of Concept:
Put `/*` into the `$gb_entry_text` variable
rjonesx has already discovered a vulnerability in Xeobook, which can be exploited to perform script insertion attacks. Because there is no released patch or something similar yet, I will not contact the vendor. To fix all these bugs you could write the complete guestbook new.
You must have register_globals enabled to run this script, disable it and edit the source code to ensure that input is properly sanitised and change all input variables. Use functions like PHP's htmlentities() and mysql_real_escape_string() functions.
10/12/2006 - Discovery of the vulnerabilities 10/12/2006 - Public disclosure
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32)
iD8DBQFFLbSlqBhP+Twks7oRCh7CAJwNUgT5OwDcgwj/1YTY58hw6sumrgCcC0/D 6/DRyVO8YVSvKsFKvtoK5gY= =yNlp -----END PGP SIGNATURE-----