New eVuln Advisory: GuestBookHost Authentication Bypass http://evuln.com/vulns/56/summary.html --------------------Summary---------------- eVuln ID: EV0056 CVE: CVE-2006-0542 Software: GuestBookHost Sowtware's Web Site: http://nukedweb.memebot.com/ Versions: 2005.04.25 Critical Level: Moderate Type: SQL Injection Class: Remote Status: Unpatched Exploit: Not Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) -----------------Description--------------- Vulnerable script: config.php Variables $email $password are not properly sanitized before being used in a SQL query. This can be used to pass authentication without password. Condition: magic_quotes_gpc - off --------------Exploit---------------------- Waiting for developer(s) reply. If there is no reply exploitation code will be published in 3 days http://evuln.com/vulns/56/exploit.html --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
