FTLS GuestBook Script Injection Vulnerability

Bugtraq ID:	6686
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 25 2003 12:00AM
Updated:	Jan 25 2003 12:00AM
Credit:	Discovery of this issue is credited to "BrainRawt ." <[email protected]>.
Vulnerable:	FTLS Guestbook 1.1
Not Vulnerable:

FTLS GuestBook Script Injection Vulnerability

Guestbook does not adequately filter HTML tags from various fields. This may enable an attacker to inject arbitrary script code into pages that are generated by the guestbook.

The attacker's script code may be executed in the web client of arbitrary users who view the pages generated by the guestbook, in the security context of the website running the software.

FTLS GuestBook Script Injection Vulnerability

The following proof of concept was provided by inserting malicious HTML code into the Title, Name and Comment fields:

<script>alert('test')</script>

FTLS GuestBook Script Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FTLS GuestBook Script Injection Vulnerability

References:

• Guestbook (FTLS)
  
• ftls.org Guestbook 1.1 Script Injection ("BrainRawt ." )