Tachyondecay Vanilla Guestbook Multiple Input Validation Vulnerabilities

Bugtraq ID:	16464
Class:	Input Validation Error
CVE:	CVE-2006-0540 CVE-2006-0541
Remote:	Yes
Local:	No
Published:	Feb 01 2006 12:00AM
Updated:	Feb 23 2007 05:46PM
Credit:	Discovery is credited to Aliaksandr Hartsuyeu.
Vulnerable:	Tachyondecay.net Vanilla Guestbook 1.0 Beta
Not Vulnerable:

Tachyondecay Vanilla Guestbook Multiple Input Validation Vulnerabilities

Vanilla Guestbook is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input that will be included in site output or in SQL queries.

Exploiting the cross-site scripting vulnerability may permit a remote attacker to steal cookie-based authentication credentials from legitimate users. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Tachyondecay Vanilla Guestbook Multiple Input Validation Vulnerabilities

No exploit is required.

Tachyondecay Vanilla Guestbook Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Tachyondecay Vanilla Guestbook Multiple Input Validation Vulnerabilities

References:

• Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities (EVuln.com)
  
• Vanilla Guestbook Web Site (Vanilla Guestbook )
  
• Vanilla Guestbook Multiple XSS & SQL Injection Vulnerabilities ([email protected])