Re: [Full-disclosure] simplog 0.9.3.2 SQL injection

2007-01-02 Thread Javor Ninov
str0ke , looks like i reinvented the wheel :-)) . i didn't make any research. a friend of mine installed the latest version of this software and voila... str0ke wrote: > Javor, > > It seems rgod found this vulnerability back in April of 2006. > > http://www.milw0rm.com/exploits/1663 > > <> >

Re: [Full-disclosure] simplog 0.9.3.2 SQL injection

2007-01-01 Thread str0ke
Javor, It seems rgod found this vulnerability back in April of 2006. http://www.milw0rm.com/exploits/1663 <> ii) http://[target]/[path]/index.php?blogid=[sql] http://[target]/[path]/archive.php?blogid=[sql] http://[target]/[path]/archive.php?m=[sql] http://[target]/[path]/archive.php?y

[Full-disclosure] simplog 0.9.3.2 SQL injection

2007-01-01 Thread Javor Ninov
Afected Software: simplog up to 0.9.3.2 (latest version - 12/05/2006 ) Site: http://www.simplog.org Simplog provides an easy way for users to add blogging capabilities to their existing websites. Simplog is written in PHP and compatible with multiple databases. Simplog also features an RSS/Atom ag