GuppY HTML Injection Vulnerability

Bugtraq ID:	8717
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 29 2003 12:00AM
Updated:	Sep 29 2003 12:00AM
Credit:	Discovered by David Suzanne <[email protected]>.
Vulnerable:	Guppy GuppY 2.4
Not Vulnerable:	Guppy GuppY 2.4 p1

GuppY HTML Injection Vulnerability

It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, "postguest.php", does not perform input validation to prevent the inclusion of HTML/script content in messages posted to the portal by remote clients. The flaw is present in the implementation of the "[c]" tag, which can be used by users posting messages in the forum or in the guestbook components of GuppY portals.

The vendor is aware of the vulnerability and has released an updated version, 2,4p1, that eliminates the issue.

GuppY HTML Injection Vulnerability

The following proof of concept has been provided:

[c=expression(alert('unsecure'))]texte[/c]

GuppY HTML Injection Vulnerability

Solution:
The vendor has released a patch and an updated version of GuppY.

Patch: http://www.freeguppy.org/file/guppy_patch2.zip
Version 2.4p1: http://www.freeguppy.org/file/guppy.zip

GuppY HTML Injection Vulnerability

References:

• ECHU.ORG Alert #4: GuppY makes XSS attacks easy ("ECHU.ORG" )