MicroGuestBook Remote XSS Attack

Advisory Content :

.:. MicroGuestBook Remote XSS Bug .:.

Date:

-----

July 2006, 22

Product:

--------

MicroGuestBook Latest Version

Vendor:

-------

http://www.phptoys.com

Description:

------------

Micro guestbook is a MySQL based guestbook script with a CSS based
attractive interface. It can store the name, date,

message, location, web and email information of the visitor.

Exploit(s)/Advisory(ies):

-------------------------

The application is vulnerable to a Remote XSS Bug. The field 'name' and
'comment' are not properly sanitized before being

used, so a malicious people can exploit this vulnerability to inject
arbitrary HTML and script code.

If you look the code in add.php you can see:

[...]

if (isset($_POST['submitBtn'])) {

$name = (isset($_POST['name'])) ? $_POST['name'] : '' ;

$comment = (isset($_POST['comment'])) ? $_POST['comment'] : '' ;

$location = (isset($_POST['location'])) ? $_POST['location'] : '' ;

$website = (isset($_POST['website'])) ? $_POST['website'] : '' ;

$email = (isset($_POST['email'])) ? $_POST['email'] : '' ;

$actDate = date("Y-m-d H:i:s");

//Minimum name and comment length.

if ((strlen($name) > 2) && (strlen($comment) > 5)){

$sql = "INSERT INTO guestbook (name,text,insertdate,location,web,email)
VALUES (";

$sql .=
"'".$name."','".$comment."','".$actDate."','".$location."','".$website."
','".$email."')";

$MyDb->f_ExecuteSql($sql);

[...]

And in index.php you will see:

[...]

<div id="name"><?php echo $row['name']; ?></div>

<div id="info">

<div id="infoicons">

<?php

if (strlen($row['web']) > 5) echo '<a href="http://'.$row['web'].'"><img
src="style/www.gif"></a>';

if (strlen($row['email']) > 5) echo '<a
href="mailto:'.$row['email'].'"><img src="style/mail.gif"></a>';

?>

</div>

<div id="infodate"><?php echo $row['insertdate']; ?></div>

</div>

</div>

<div id="base">

<div id="icon"><?php echo $row['location']; ?></div>

<div id="text"><?php echo nl2br($row['text']); ?></div>

[...]

PoC(s):

-------

You can put your own HTML or script code in the field name or comment.
Try:

<script>alert("XSS")</script>

Vendor Status:

--------------

[July 2006, 22] Vendor contacted!

Patches:

--------

[July 2006, 22] At the moment there is no patch available from the vendor.
You can take a look at this site if a patch will

be posted up:

http://www.phptoys.com

If you don't wanna wait, edit the source code to ensure that input is
properly sanitised.

Credits:

--------

omnipresent

omnipresent[at]email[dot]it

http://it.security.netsons.org

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

MicroGuestBook Remote XSS Attack