In-Reply-To: <8ea2ac2004120211406650777b (at) mail.gmail (dot) com [email concealed]>

The previous version of Advance Guestbook (2.2) also vulnerable to XSS

yours,

SpyHat

>Received: (qmail 10259 invoked from network); 3 Dec 2004 06:52:14 -0000

>Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26)

> by mail.securityfocus.com with SMTP; 3 Dec 2004 06:52:14 -0000

>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])

> by outgoing2.securityfocus.com (Postfix) with QMQP

> id B9461150062; Thu, 2 Dec 2004 13:35:23 -0700 (MST)

>Mailing-List: contact bugtraq-help (at) securityfocus (dot) com [email concealed]; run by ezmlm

>Precedence: bulk

>List-Id: <bugtraq.list-id.securityfocus.com>

>List-Post: <mailto:bugtraq (at) securityfocus (dot) com [email concealed]>

>List-Help: <mailto:bugtraq-help (at) securityfocus (dot) com [email concealed]>

>List-Unsubscribe: <mailto:bugtraq-unsubscribe (at) securityfocus (dot) com [email concealed]>

>List-Subscribe: <mailto:bugtraq-subscribe (at) securityfocus (dot) com [email concealed]>

>Delivered-To: mailing list bugtraq (at) securityfocus (dot) com [email concealed]

>Delivered-To: moderator for bugtraq (at) securityfocus (dot) com [email concealed]

>Received: (qmail 32371 invoked from network); 2 Dec 2004 12:38:25 -0000

>DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

> s=beta; d=gmail.com;

> h=received:message-id:date:from:reply-to:to:subject:mime-version:content
-type:content-transfer-encoding;

> b=ZzuHyFaU5dWXZZZ6ks4DM8A7YxZdqOaW+R9+TGOJeGPg3nc7gK0eeTRqw3kIfp+WNs8gSp
gvnDrdU+favNNKH8oxl/NKuuS4N2L96onsg9TbDzXZmnQSCmKbQxnOWLhv5EiLUStZIX5ZO+
kq6QpKnftsFB76e1mqe12VGww+MEE=

>Message-ID: <8ea2ac2004120211406650777b (at) mail.gmail (dot) com [email concealed]>

>Date: Thu, 2 Dec 2004 20:40:21 +0100

>From: Emile van Elen <emile.van.elen (at) gmail (dot) com [email concealed]>

>Reply-To: Emile van Elen <emile.van.elen (at) gmail (dot) com [email concealed]>

>To: bugtraq (at) securityfocus (dot) com [email concealed]

>Subject: Advanced Guestbook

>Mime-Version: 1.0

>Content-Type: text/plain; charset=US-ASCII

>Content-Transfer-Encoding: 7bit

>

>There's a XSS in Advanced Guestbook 2.3.1

>

>For example:

>

>index.php?entry=<script>alert(document.cookie)</script>

>

>

>greetings,

>--

>Emile van Elen

>

[ reply ]