Gerry GuestBook 'gbText' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	49694
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 20 2011 12:00AM
Updated:	Sep 20 2011 12:00AM
Credit:	Pr@fesOr X
Vulnerable:	Gerry GuestBook Gerry GuestBook 1.21
Not Vulnerable:

Gerry GuestBook 'gbText' Parameter Cross Site Scripting Vulnerability

Gerry GuestBook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Gerry GuestBook 1.21 is vulnerable; other versions may also be affected.

Gerry GuestBook 'gbText' Parameter Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Gerry GuestBook 'gbText' Parameter Cross Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Gerry GuestBook 'gbText' Parameter Cross Site Scripting Vulnerability

References:

• Product Homepage (Gerry)