New Advisory: X-script GuestBook http://www.security-news.ws --------------------Summary---------------- Software: x-script GuestBook Sowtware's Web Site: http://x-script.net.ru Versions: 1.3a Critical Level: Moderate Type: Multiple Vulnerabilities Class: Remote Status: Unpatched PoC/Exploit: Not Available Solution: Not Available Discovered by: Security-news.ws -----------------Description--------------- 1. SQL Injection. Vulnerable script: mes_add.php Parameters 'name', 'email', 'icq', 'website' is not properly sanitized before being used in SQL query. This can be used to make SQL queries by injecting arbitrary SQL code. Condition: magic_quotes_gpc = off --------------PoC/Exploit---------------------- Waiting for developer(s) reply. --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: security-news.ws