Secunia

OS2A has discovered a vulnerability in myBloggie, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "username" parameter in "login.php" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerability has been confirmed in version 2.12, and has also been reported in version 2.1.3-beta and prior. Other versions may also be affected.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
OS2A

Additional information provided by:
rgod

Changelog
Further details available in Customer Area

Original Advisory
http://rgod.altervista.org/mybloggie213b.html

Deep Links
Links available in Customer Area