GuppY PrintFAQ.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	14752
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 06 2005 12:00AM
Updated:	Sep 06 2005 12:00AM
Credit:	Romano_45 is credited with the discovery of this vulnerability.
Vulnerable:	Guppy GuppY 4.5.3 a Guppy GuppY 4.5.3 Guppy GuppY 4.5
Not Vulnerable:	Guppy GuppY 4.5.4

GuppY PrintFAQ.PHP Cross-Site Scripting Vulnerability

GuppY is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

GuppY PrintFAQ.PHP Cross-Site Scripting Vulnerability

No exploit is required.

GuppY PrintFAQ.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update addressing this issue:


Guppy GuppY 4.5

• GuppY gy_upg_454.zip
  http://www.freeguppy.org/file/gy_upg_454.zip

Guppy GuppY 4.5.3 a

• GuppY gy_upg_454.zip
  http://www.freeguppy.org/file/gy_upg_454.zip

Guppy GuppY 4.5.3

• GuppY gy_upg_454.zip
  http://www.freeguppy.org/file/gy_upg_454.zip

GuppY PrintFAQ.PHP Cross-Site Scripting Vulnerability

References:

• GuppY 4.5.4 Upgrade Changelog (GuppY)
  
• GuppY Homepage (GuppY)