DRBGuestbook Index.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	25911
Class:	Input Validation Error
CVE:	CVE-2007-5218
Remote:	Yes
Local:	No
Published:	Oct 03 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	Gokhan is credited with the discovery of this vulnerability.
Vulnerable:	hotscripts DRBGuestbook 1.1.13
Not Vulnerable:	hotscripts DRBGuestbook 1.1.14

DRBGuestbook Index.PHP Cross-Site Scripting Vulnerability

DRBGuestbook is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects DRBGuestbook 1.1.13; other versions may also be vulnerable.

DRBGuestbook Index.PHP Cross-Site Scripting Vulnerability

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/25911.html

DRBGuestbook Index.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor has released DRBGuestbook 1.1.14 to address this issue. Please see the references for more information.


hotscripts DRBGuestbook 1.1.13

• hotscripts DRBGuestbook 1.1.14
  http://www.dbscripts.net/download/?file=2

DRBGuestbook Index.PHP Cross-Site Scripting Vulnerability

References:

• DRBGuestbook Homepage (hotscripts)
  
• DRBGuestbook Version 1.1.14 released (DBScripts.net)
  
• DRBGuestbook Remote XSS Vulnerability (gokhankaya)