[34641] in bugtraq
Advanced Guestbook 2.2 -- SQL Injection Exploit
daemon@ATHENA.MIT.EDU (JQ)
Wed Apr 21 17:16:30 2004
Date: 21 Apr 2004 10:36:32 -0000
Message-ID: <20040421103632.8258.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: JQ <idiosyncrasie@xs4all.nl>
To: bugtraq@securityfocus.com
The widely-used Advanced Guestbook 2.2 webapplication (PHP, MySQL) appears vulnerable to SQL Injection granting the attacker administrator access. The attack is very simple and consists of inputting the following password string leaving the username entry blank:
') OR ('a' = 'a
Regards,
JQ
