[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
ZH2003-26SA (security advisory): TSguestbook Ver. 2.1 Cross-Site Scripting Vulnerability
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: ZH2003-26SA (security advisory): TSguestbook Ver. 2.1 Cross-Site Scripting Vulnerability
- From: Jim Pangalos <dpangalos@xxxxxxxxxxxxx>
- Date: 1 Sep 2003 02:11:29 -0000
ZH2003-26SA (security advisory): TSguestbook Ver. 2.1 Cross-Site Scripting
Vulnerability
Published: 31/08/2003
Released: 31/08/2003
Name: TSguestbook (http://www.tsinter.net)
Affected System(s): All versions
Issue: Remote attackers can insect XSS script
Author: Trash-80 - dpangalos@xxxxxxxxxxxxx
Description
************
Zone-h Security Team has discovered a flaw in TSguestbook Ver. 2.1.
TSguestbook is an object orientated guestbook. It doesn't require a MySQL
database.
Details
********
It's possibile to insert XSS script in the message variable.
For example try this:
Name: Zone-h Security Team
Email: test@xxxxxxxx
ICQ: 11111111
Homepage: http://www.zone-h.org
Message:<script>alert('Zone-H')</script>
Solution
*********
The vendor has been contacted and a patch is not yet produced.
Suggestions
************
Filter the message variable.
Trash-80 - www.zone-h.org operator