[UNIX] Micro Guestbook XSS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Micro Guestbook XSS
------------------------------------------------------------------------


SUMMARY

<http://www.phptoys.com/e107_plugins/content/content.php?content.10>
Micro Guestbook is "a MySQL based guestbook script with a CSS based
attractive interface. It can store the name, date, message, location, web
and email information of the visitor". A cross site scripting
vulnerability in Micro Guestbook allows remote attackers to insert
arbitrary HTML and/or Javascript into the pages returned by the product.

DETAILS

The application is vulnerable to a Remote XSS Bug. The field 'name' and
'comment' are not properly sanitized before being used, so a malicious
people can exploit this vulnerability to inject arbitrary HTML and script
code.

Vulnerable code:
If you look the code in add.php you can see:
[...]

if (isset($_POST['submitBtn'])) {
$name = (isset($_POST['name'])) ? $_POST['name'] : '' ;
$comment = (isset($_POST['comment'])) ? $_POST['comment'] : '' ;
$location = (isset($_POST['location'])) ? $_POST['location'] : ''
;
$website = (isset($_POST['website'])) ? $_POST['website'] : '' ;
$email = (isset($_POST['email'])) ? $_POST['email'] : '' ;
$actDate = date("Y-m-d H:i:s");

//Minimum name and comment length.
if ((strlen($name) > 2) && (strlen($comment) > 5)){
$sql = "INSERT INTO guestbook
(name,text,insertdate,location,web,email) VALUES (";
$sql .=
"'".$name."','".$comment."','".$actDate."','".$location."','".$website."','".$email."')";
$MyDb->f_ExecuteSql($sql);

[...]

And in index.php you will see:

[...]

<div id="name"><?php echo $row['name']; ?></div>
<div id="info">
<div id="infoicons">
<?php
if (strlen($row['web']) > 5) echo '<a
href="http://'.$row['web'].'"><img src="style/www.gif"></a>';
if (strlen($row['email']) > 5) echo '<a
href="mailto:'.$row['email'].'"><img src="style/mail.gif"></a>';
?>
</div>
<div id="infodate"><?php echo $row['insertdate']; ?></div>
</div>
</div>
<div id="base">
<div id="icon"><?php echo $row['location']; ?></div>
<div id="text"><?php echo nl2br($row['text']); ?></div>

[...]

Proof of Concept:
You can put your own HTML or script code in the field name or comment.
Try: <script>alert("XSS")</script>


ADDITIONAL INFORMATION

The information has been provided by <mailto:omnipresent@xxxxxxxx>
omnipresent.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] Multiple Vulnerabilities in Phorum (common.php, common.php, login.php, register.php)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Phorum is "an Open Source web based discussion ... An XSS vulnerability exists in the script 'common.php' that allows ... By sending a HTTP/POST variable to any Phorum script, ...
    (Securiteam)
  • [UNIX] Multiple Vulnerabilities in Psychoblogger CMS Package
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... There is a Cross-Site-Scripting vulnerability in the script ... Another SQL-Injection vulnerability exists in the comments.php script, ... This string manipulates the SQL query into looking something like this: ...
    (Securiteam)
  • [NEWS] Multiple HP Web JetAdmin Vulnerabilities (DoS, Upload, Write, Read, Command Execution)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... script, used in conjunction with other vulnerable files allow us to use ... File reading vulnerability as well as HTS script injection ... can create files in the Administrators startup folder. ...
    (Securiteam)
  • [NT] Horde Multiple XSS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... based on PHP and the Horde Framework." ... Horde is subject to a client side script injection vulnerability in the ...
    (Securiteam)
  • [UNIX] Mantis Bug Tracker Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... any HTML or script code can be injected. ... * Another XSS vulnerability can be found in the signup.php script (ex.: ... there is also a remote PHP code execution in the system. ...
    (Securiteam)