Multiple SQL injection vulnerabilities in mes_add.php in x-script GuestBook 1.3a when magic_quotes_gpc is disabled allow remote attackers to execute arbitrary SQL commands via the (1) name (2) email (3) icq and (4) website parameters.