[31382] in bugtraq
ZH2003-26SA (security advisory): TSguestbook Ver. 2.1 Cross-Site
daemon@ATHENA.MIT.EDU (Jim Pangalos)
Tue Sep 2 14:58:12 2003
Date: 1 Sep 2003 02:11:29 -0000
Message-ID: <20030901021129.30715.qmail@sf-www2-symnsj.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Jim Pangalos <dpangalos@linuxmail.org>
To: bugtraq@securityfocus.com
ZH2003-26SA (security advisory): TSguestbook Ver. 2.1 Cross-Site Scripting
Vulnerability
Published: 31/08/2003
Released: 31/08/2003
Name: TSguestbook (http://www.tsinter.net)
Affected System(s): All versions
Issue: Remote attackers can insect XSS script
Author: Trash-80 - dpangalos@linuxmail.org
Description
************
Zone-h Security Team has discovered a flaw in TSguestbook Ver. 2.1.
TSguestbook is an object orientated guestbook. It doesn't require a MySQL
database.
Details
********
It's possibile to insert XSS script in the message variable.
For example try this:
Name: Zone-h Security Team
Email: test@test.com
ICQ: 11111111
Homepage: http://www.zone-h.org
Message:<script>alert('Zone-H')</script>
Solution
*********
The vendor has been contacted and a patch is not yet produced.
Suggestions
************
Filter the message variable.
Trash-80 - www.zone-h.org operator
