This advisory and other useful files can
be found at http://www.blacktigerz.org
Date:
07.04.2003
Subject:
Orplex guestbook script injection.
Description:
Free asp guestbook. Main fetures are:inserting
smiles as icons; web-based administration; bad word
filtering.
Vendor:
Orplex consulting inc.
http://www.orplex.com
Vulnerability:
addentry.asp neglects filtering user input allowing
for script injection to the guestbook via "Name"
and "Massage" fields. The injected script will be
executed in anyones browser who visits the guestbook.
Black Tigerz Research Group
We are:Areus,Barracuda,n1Tr0f4n,Velzevol,drG4njubas.
Please visit our website: http://www.blacktigerz.org
be found at http://www.blacktigerz.org
Date:
07.04.2003
Subject:
Orplex guestbook script injection.
Description:
Free asp guestbook. Main fetures are:inserting
smiles as icons; web-based administration; bad word
filtering.
Vendor:
Orplex consulting inc.
http://www.orplex.com
Vulnerability:
addentry.asp neglects filtering user input allowing
for script injection to the guestbook via "Name"
and "Massage" fields. The injected script will be
executed in anyones browser who visits the guestbook.
Black Tigerz Research Group
We are:Areus,Barracuda,n1Tr0f4n,Velzevol,drG4njubas.
Please visit our website: http://www.blacktigerz.org
[ reply ]