Home / os / win7

G5 Scripts Guestbook PHP v1.2.8 XSS Vulnerability

Posted on 24 April 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>G5 Scripts Guestbook PHP v1.2.8 XSS Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=================================================
G5 Scripts Guestbook PHP v1.2.8 XSS Vulnerability
=================================================

[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
&gt;&gt; General Information
Advisory/Exploit Title = Guestbook PHP XSS Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org
 
 
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
&gt;&gt; Product information
Name = Guestbook PHP
Vendor = G5 Scripts
Vendor Website = http://www.g5-scripts.de
Affected Version(s) = 1.2.8
 
  
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
&gt;&gt; #1 Vulnerability
Type = XSS
Affected Input Boxes = &quot;Name&quot;, &quot;Vorname&quot;, &quot;Land&quot;, &quot;Message&quot;
 
The guestbook fails to properly sanitize the user input when a new entry is added.
When HTML/Java Script code is added, it gets displayed/parsed when the new entry was
successfully submitted.
 
Furthermore the code gets executed when the admin views the entries in the control panel.
It is even possible to temporarily disable the admin features in the backend
since the injected code gets executed before the admin buttons get displayed.
When the correct code was injected, the design gets destroyed and the admin buttons disappear.
 
 
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
&gt;&gt; Additional Information
Advisory/Exploit Published = 24.04.2010
 
 
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
&gt;&gt; Misc
Greetz &amp;&amp; Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
&lt;3 packetstormsecurity.org!
 
 
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-04-24]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :