Psychoblogger Multiple SQL Injection Vulnerabilities

Bugtraq ID:	9294
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 24 2003 12:00AM
Updated:	Dec 24 2003 12:00AM
Credit:	The disclosure of these issues has been credited to Andrew Smith <[email protected]>.
Vulnerable:	Psychoblogger Psychoblogger PB-beta1
Not Vulnerable:

Psychoblogger Multiple SQL Injection Vulnerabilities

It has been reported that Psychoblogger may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic to disclose sensitive information that could be used to gain unauthorized access. The issues exist in 'shouts.php', 'comments.php', and 'category.php' scripts.

Psychoblogger version PB-beta1 has been reported to be prone to these issues, however, other versions could be affected as well.

Psychoblogger Multiple SQL Injection Vulnerabilities

No exploit is required.

Psychoblogger Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Psychoblogger Multiple SQL Injection Vulnerabilities

References:

• Psychoblogger Product Page (Psychoblogger)
  
• Multiple Vulns in Psychoblogger beta1 (Andrew Smith )