Description
A SQL injection filter bypass vulnerability exists in phsBlog 0.2. The application implements basic SQL injection filtering that can be circumvented using encoding techniques and alternative SQL syntax.
Impact
Attackers can bypass the inadequate input filters to inject SQL commands, potentially extracting all data from the database including user credentials, blog posts, and administrative information.
Solution
Replace custom SQL filtering with parameterized queries (prepared statements). Upgrade to a maintained blogging platform.