Advanced Guestbook Cross-Site Scripting Vulnerability
BID:11798
Info
Advanced Guestbook Cross-Site Scripting Vulnerability
| Bugtraq ID: | 11798 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 02 2004 12:00AM |
| Updated: | Dec 02 2004 12:00AM |
| Credit: | Emile van Elen <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Advanced Guestbook Advanced Guestbook 2.3.1 Advanced Guestbook Advanced Guestbook 2.2 |
| Not Vulnerable: | |
Discussion
Advanced Guestbook Cross-Site Scripting Vulnerability
It is reported that Advanced Guestbook is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.
This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
This vulnerability is reported to exist in version 2.3.1 of Advanced Guestbook. Other versions may also be affected.
Update: Stewart Souter <[email protected]> reports that this vulnerability may not be present. This BID may be retired in the future, pending further analysis.
It is reported that Advanced Guestbook is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.
This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
This vulnerability is reported to exist in version 2.3.1 of Advanced Guestbook. Other versions may also be affected.
Update: Stewart Souter <[email protected]> reports that this vulnerability may not be present. This BID may be retired in the future, pending further analysis.
Exploit / POC
Advanced Guestbook Cross-Site Scripting Vulnerability
An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com/index.php?entry=<script>alert(document.cookie)</script>
An example URI sufficient to exploit this vulnerability was provided:
http://www.example.com/index.php?entry=<script>alert(document.cookie)</script>
Solution / Fix
Advanced Guestbook Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Advanced Guestbook Cross-Site Scripting Vulnerability
References:
References:
- Advanced Guestbook Homepage (Advanced Guestbook)
- Advanced Guestbook (Emile van Elen
- Re: Advanced Guestbook (Spy Hat
- Re: Advanced Guestbook (Stewart Souter