-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

Advisory: TP-Book <= 1.00 Cross Site Scripting Vulnerabilities

Release Date: 2006/07/25

Last Modified: 2006/07/25

Author: Tamriel [tamriel at gmx dot net]

Application: TP-Book <= 1.00

Risk: Low

Vendor Status: not contacted

Vendor Site: tobias.kloy.googlepages.com

Overview:

Quote from tobias.kloy.googlepages.com:

"Das Gaestebuch verfuegt über folgende Features:

- Anpassbare Templates

- Viele Systeme, um Dauerspammer auszuschließen

- Admincontrol-Panel

- Einfache Installation durch einen Wizard"

Details:

In your guestbook posts the name will not be checked by the script.

Attackers can so perform cross site scripting attacks.

Solution:

Take a view on PHP's htmlentities function.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.3

iD8DBQFExnkWqBhP+Twks7oRAo+tAJ9xQfU3nR2GdQFpihUfYvZMRcjeOACeM5u8

9pRIeeb4mDLWby9rlVGfMsU=

=sTzT

-----END PGP SIGNATURE-----

[ reply ]