[24723] in bugtraq
[ARL02-A08] BG Guestbook Cross Site Scripting Vulnerability
daemon@ATHENA.MIT.EDU (Ahmet Sabri ALPER)
Mon Mar 18 21:10:39 2002
Date: 16 Mar 2002 23:10:03 -0000
Message-ID: <20020316231003.17027.qmail@mail.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Ahmet Sabri ALPER <s_alper@hotmail.com>
To: bugtraq@securityfocus.com
+/--------\-------- ALPER Research Labs ------/--------/+
+/---------\------- Security Advisory -----/---------/+
+/----------\------ ID: ARL02-A08 ----/----------/+
+/-----------\----- salper@olympos.org ---/-----------/+
Advisory Information
--------------------
Name : BG Guestbook Cross Site Scripting
Vulnerability
Software Package : BG Guestbook
Vendor Homepage : http://billyg.no-
ip.com:8080/bggb/
Vulnerable Versions: v1.0
Platforms : PHP & MySQL dependent
Vulnerability Type : Input Validation Error
Vendor Contacted : 15/03/2002
Vendor Replied : waiting for reply (5 days left)
Prior Problems : N/A
Current Version : v1.1 (immune)
Summary
-------
BG GuestBook a php guestbook that utilizes mysql,
has a Macromedia Flash interface and is also
capable of using HTML only, where Flash is not
supported.
A Cross Site Scripting vulnerability exists in BG
GuestBook. This would allow a remote attacker to
send information to victims from untrusted web
servers, and make it look as if the information
came from the legitimate server.
Details
-------
Both the Flash and HTML only versions are
vulnerable to Cross Site Scripting attacks.
All of the input fields (including name, email, AIM,
location, website and message) in the posting form
are vulnerable to this type of attack.
Example input to any of the above fields:
<script>alert("ALPERz was here!")</script>
After submitting this information, whenever anyone
browses the guestbook's main page, the script will
take effect.
Solution
--------
The vendor confirmed the vulnerability and released a
new version on the same day of the bug's discovery.
I suggested the following as a workaround:
Strip HTML tags, and possibly other malicious code
within "signgbook.php".
I suggest the following as a workaround;
At the beginning of "signgbook.php" add the lines
below;
# Patch Start
$name= strip_tags ($name);
$email= strip_tags ($email);
$aimscr= strip_tags ($aimscr);
$website= strip_tags ($website);
$loc= strip_tags ($loc);
$msg= strip_tags ($msg);
# Patch End
Credits
-------
Discovered on 15, March, 2002 by
Ahmet Sabri ALPER
salper@olympos.org
http://www.olympos.org
References
----------
Product Web Page: http://billyg.no-ip.com:8080/bggb/
