AN Guestbook 'send_email.php' Cross Site Scripting Vulnerability

Bugtraq ID:	29254
Class:	Input Validation Error
CVE:	CVE-2008-2414
Remote:	Yes
Local:	No
Published:	May 16 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	ZoRLu
Vulnerable:	AN Guestbook AN Guestbook 0.4
Not Vulnerable:	AN Guestbook AN Guestbook 0.7

AN Guestbook 'send_email.php' Cross Site Scripting Vulnerability

AN Guestbook (ANG) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ANG 0.4 is vulnerable; other versions may also be affected.

AN Guestbook 'send_email.php' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

The following example URI is available:

http://www.example.com/ang/send_email.php?postid=[XSS]

AN Guestbook 'send_email.php' Cross Site Scripting Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


AN Guestbook AN Guestbook 0.4

• AN Guestbook ang_0_7_5.zip
  http://prdownloads.sourceforge.net/aguestbook/ang_0_7_5.zip?download

AN Guestbook 'send_email.php' Cross Site Scripting Vulnerability

References:

• AN Guestbook Homepage (AN Guestbook)