Ades Design AdesGuestbook Read Script Cross-Site Scripting Vulnerability

Bugtraq ID:	16090
Class:	Input Validation Error
CVE:	CVE-2005-4596
Remote:	Yes
Local:	No
Published:	Dec 30 2005 12:00AM
Updated:	Apr 13 2007 04:01PM
Credit:	Discovery is credited to rakstija r0t3d3Vil.
Vulnerable:	Ades Design AdesGuestbook 2.0
Not Vulnerable:	Ades Design AdesGuestbook 2.1

Ades Design AdesGuestbook Read Script Cross-Site Scripting Vulnerability

Ades Design AdesGuestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Ades Design AdesGuestbook Read Script Cross-Site Scripting Vulnerability

The following example was provided:

/read.php?pageNum_rsRead=1&totalRows_rsRead=[XSS]

Ades Design AdesGuestbook Read Script Cross-Site Scripting Vulnerability

Solution:
The vendor has released version 2.1 to address this issue.


Ades Design AdesGuestbook 2.0

• Ades Design Ades Guestbook 2.1
  http://www.adesdesign.net/cgi-bin/download.pl?file=AdesGuestbook.zip

Ades Design AdesGuestbook Read Script Cross-Site Scripting Vulnerability

References:

• AdesGuestbook Homepage (Ades Design)
  
• AdesGuestbook XSS vuln. (rakstija r0t3d3Vil)