Secunia

farhad koosha has discovered two vulnerabilities in AspJar Guestbook, which can be exploited by malicious people to conduct SQL injection attacks and bypass certain security restrictions.

1) Input passed to the "User" and "Password" parameters in "login.asp" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

2) Missing authorisation in "delete.asp" can be exploited to delete arbitrary messages.

The vulnerabilities have been confirmed in version 1.0. Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
farhad koosha

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area