TUCoPS :: Web :: Blogs :: b06-1968.htm

sBlog SQL Injection and Path Disclosure Vulnerability
sBlog SQL Injection and Path Disclosure Vulnerability
sBlog SQL Injection and Path Disclosure Vulnerability



Summary:=0D
Software: sBlog 0.7.2=0D
Site: http://servous.se/=0D 
Description: sBlog is a simple and new PHP Blog. =0D
=0D
Issue: Conducting a security benchmark on this open source software we have found that most of the versions of this software is prone to SQL Injection attack through which an attacker can trigger back sensitive information as well as gain administrative priviledges. The sql injection also discloses path information which may prove additional aid to the attacker.An unauthenticated attacker may execute arbitrary SQL statements on the web. This may compromise the database and expose sensitive information.=0D
=0D
=0D
=========================================0D
=0D
PROOF OF CONCEPT : http://www.subjectzero.net/research/sblog.htm=0D 
=0D
=======================================

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH