Chipmunk Guestbook Index.PHP SQL Injection Vulnerability

Bugtraq ID:	17483
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 12 2006 12:00AM
Updated:	Apr 13 2006 03:32PM
Credit:	Dr.Jr7 is credited with the discovery of this vulnerability.
Vulnerable:	Chipmunk PHP Scripts Chipmunk Guestbook 1.3
Not Vulnerable:	Chipmunk PHP Scripts Chipmunk Guestbook 1.4

Chipmunk Guestbook Index.PHP SQL Injection Vulnerability

Chipmunk Guestbook is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Chipmunk Guestbook Index.PHP SQL Injection Vulnerability


This issue can be exploited through a web client.

The following proof of concept is available:
http://www.example.com/user/index.php?SID=[SQL]

Chipmunk Guestbook Index.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]


Chipmunk PHP Scripts Chipmunk Guestbook 1.3

• Chipmunk PHP Scripts guestbooks.zip
  http://www.chipmunk-scripts.com/guestbook/guestbooks.zip

Chipmunk Guestbook Index.PHP SQL Injection Vulnerability

References:

• Guestbook Homepage (Chipmunk)