13 lines
No EOL
730 B
Text
13 lines
No EOL
730 B
Text
source: https://www.securityfocus.com/bid/10209/info
|
|
|
|
It has been reported that Advanced Guestbook is prone to a SQL injection vulnerability that could allow an attacker to gain administrative access to the application.
|
|
|
|
This issue is reported to exist in Advanced Guestbook 2.2, however, it is possible that other versions are affected as well.
|
|
|
|
JQ <idiosyncrasie@xs4all.nl> explains that it is possible to trigger this issue by leaving the username entry blank and entering the following string in the password field:
|
|
|
|
') OR ('a' = 'a
|
|
|
|
Spy Hat <spyhat@spyhat.com> comments that it is also possible to leverage this issue by leaving the password field blank and entering the following string into the username field:
|
|
|
|
? or 1=1 -- |