.:. MicroGuestBook Remote XSS Bug .:.
Date:
-----
July 2006, 22
Product:
--------
MicroGuestBook Latest Version
Vendor:
-------
http://www.phptoys.com
Description:
------------
Micro guestbook is a MySQL based guestbook script with a CSS based attractive interface. It can store the name, date,
message, location, web and email information of the visitor.
Exploit(s)/Advisory(ies):
-------------------------
The application is vulnerable to a Remote XSS Bug. The field 'name' and 'comment' are not properly sanitized before being
used, so a malicious people can exploit this vulnerability to inject arbitrary HTML and script code.
If you look the code in add.php you can see:
[...]
if (isset($_POST['submitBtn'])) {
$name = (isset($_POST['name'])) ? $_POST['name'] : '' ;
$comment = (isset($_POST['comment'])) ? $_POST['comment'] : '' ;
$location = (isset($_POST['location'])) ? $_POST['location'] : '' ;
$website = (isset($_POST['website'])) ? $_POST['website'] : '' ;
$email = (isset($_POST['email'])) ? $_POST['email'] : '' ;
$actDate = date("Y-m-d H:i:s");
//Minimum name and comment length.
if ((strlen($name) > 2) && (strlen($comment) > 5)){
$sql = "INSERT INTO guestbook (name,text,insertdate,location,web,email) VALUES (";
$sql .= "'".$name."','".$comment."','".$actDate."','".$location."','".$website."
','".$email."')";
$MyDb->f_ExecuteSql($sql);
[...]
And in index.php you will see:
[...]
<div id="name"><?php echo $row['name']; ?></div>
<div id="info">
<div id="infoicons">
<?php
if (strlen($row['web']) > 5) echo '<a href="http://'.$row['web'].'"><img src="style/www.gif"></a>';
if (strlen($row['email']) > 5) echo '<a href="mailto:'.$row['email'].'"><img src="style/mail.gif"></a>';
?>
</div>
<div id="infodate"><?php echo $row['insertdate']; ?></div>
</div>
</div>
<div id="base">
<div id="icon"><?php echo $row['location']; ?></div>
<div id="text"><?php echo nl2br($row['text']); ?></div>
[...]
PoC(s):
-------
You can put your own HTML or script code in the field name or comment. Try:
<script>alert("XSS")</script>
Vendor Status:
--------------
[July 2006, 22] Vendor contacted!
Patches:
--------
[July 2006, 22] At the moment there is no patch available from the vendor. You can take a look at this site if a patch will
be posted up:
http://www.phptoys.com
If you don't wanna wait, edit the source code to ensure that input is properly sanitised.
Credits:
--------
omnipresent
omnipresent[at]email[dot]it
http://it.security.netsons.org
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum