[eVuln] Skull-Splitter's PHP Guestbook XSS Vulnerability Mar 29 2006 05:42AM
alex evuln com
New eVuln Advisory:
Skull-Splitter's PHP Guestbook XSS Vulnerability

eVuln ID: EV0104
CVE: CVE-2006-1256
Software: Skull-Splitter's PHP Guestbook
Sowtware's Web Site: http://www.boysen.be/
Versions: 2.6 2.7
Critical Level: Harmless
Type: Cross-Site Scripting
Class: Remote
Status: Patched
PoC/Exploit: Available
Solution: Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Vulnerable Script: guestbook.php

Parameter url isn't properly sanitized. This can be used to post arbitrary HTML or JavaScript code.

Condition: magic_quotes_gpc = off

Available at: http://evuln.com/vulns/104/exploit.html

To fix this problem install or upgrade to 2.75 version provided by vendor.

Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus