Tri Dung Nguyen Free Perl Guestbook BBCode HTML Injection Vulnerability

Bugtraq ID:	10665
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 05 2004 12:00AM
Updated:	Jul 05 2004 12:00AM
Credit:	Discovery is credited to Joshua P. Miller <[email protected]>.
Vulnerable:	Tri Dung Nguyen Free Perl Guestbook 1.25
Not Vulnerable:

Tri Dung Nguyen Free Perl Guestbook BBCode HTML Injection Vulnerability

Free Perl Guestbook is prone to an HTML injection vulnerability. This issue is exposed through the application's BBCode implementation.

Since this could permit an attacker to inject hostile HTML into a site, it is possible to steal cookie credentials or misrepresent site content.

Free Perl Guestbook 1.25 is reported prone to this issue, however, it is possible that other versions are affected as well.

Tri Dung Nguyen Free Perl Guestbook BBCode HTML Injection Vulnerability

No exploit is required.

Tri Dung Nguyen Free Perl Guestbook BBCode HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Tri Dung Nguyen Free Perl Guestbook BBCode HTML Injection Vulnerability

References:

• Free Perl Guestbook (Medius Mode)