MyBloggie login.php SQL Injection Vulnerability

Bugtraq ID:	14739
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 05 2005 12:00AM
Updated:	Sep 05 2005 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	myWebland myBloggie 2.1.3 myWebland myBloggie 2.1.2 myWebland myBloggie 2.1.1
Not Vulnerable:

MyBloggie login.php SQL Injection Vulnerability

myBloggie is prone to a SQL injection vulnerability in the 'login.php' script.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

MyBloggie login.php SQL Injection Vulnerability

An exploit is not required.

MyBloggie login.php SQL Injection Vulnerability

Solution:
A fix is available:


myWebland myBloggie 2.1.1

• myWebland myBloggie patch
  http://mywebland.com/downloads/login.php

myWebland myBloggie 2.1.2

• myWebland myBloggie patch
  http://mywebland.com/downloads/login.php

myWebland myBloggie 2.1.3

• myWebland myBloggie patch
  http://mywebland.com/downloads/login.php

MyBloggie login.php SQL Injection Vulnerability

References:

• Critical Security Update - myBloggie 2.1.X version (myWebland)
  
• Homepage (myWebland)