Woltlab Burning Book addentry.php SQL Injection

From: Martin Heistermann <martin.heistermann_at_web.de>
Date: 10 Jan 2005 19:10:54 -0000

('binary' encoding is not supported, stored as-is) Advisory Information
--------------------
Advisory name : Woltlab Burning Book addentry.php SQL Injection
Discovered by : drhankey / it-security23.net
Vendor Name : Woltlab
Vendor Homepage : http://www.woltlab.de
Software : Woltlab Burning Book Lite
Vulnerability Type : Cross-Site-Scripting
Vulnerable Versions : 1.0 Gold, 1.1.1e, maybe more
Platforms : OS Independent, PHP


What is Woltlab Burning Book ?
----------------------------------
Woltlab Burning Board Lite is a free guestbook system.


Vulnerability Description:
-------------------------
When you post a message, addentry.php executes a SQL Query writing it in the db. The

user-agent is also saved, but not filtered. So its possible to modify the SQL Query when you

change your user-agent.
Received on Jan 11 2005