bugtraq - Re: Advanced Guestbook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 22 Jan 2005 13:53:06 -0000
From: Stewart Souter <webmaster@...bonize.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: Advanced Guestbook


In-Reply-To: <8ea2ac2004120211406650777b@...l.gmail.com>

This exploit does not exist. I wish people would actually check their facts before crying wolf. Advanced guestbook 2.3.1 already checks the URL as it is submitted. It uses the following if statement.

if (htmlspecialchars($this->url) != "$this->url") {
  $this->url = '';
}

which can be found in lib/add.entry.php.

regards,
Carbonize

>Received: (qmail 10259 invoked from network); 3 Dec 2004 06:52:14 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26)
>  by mail.securityfocus.com with SMTP; 3 Dec 2004 06:52:14 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
>	by outgoing2.securityfocus.com (Postfix) with QMQP
>	id B9461150062; Thu,  2 Dec 2004 13:35:23 -0700 (MST)
>Mailing-List: contact bugtraq-help@...urityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@...urityfocus.com>
>List-Help: <mailto:bugtraq-help@...urityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@...urityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@...urityfocus.com>
>Delivered-To: mailing list bugtraq@...urityfocus.com
>Delivered-To: moderator for bugtraq@...urityfocus.com
>Received: (qmail 32371 invoked from network); 2 Dec 2004 12:38:25 -0000
>DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
>        s=beta; d=gmail.com;
>        h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding;
>        b=ZzuHyFaU5dWXZZZ6ks4DM8A7YxZdqOaW+R9+TGOJeGPg3nc7gK0eeTRqw3kIfp+WNs8gSpgvnDrdU+favNNKH8oxl/NKuuS4N2L96onsg9TbDzXZmnQSCmKbQxnOWLhv5EiLUStZIX5ZO+kq6QpKnftsFB76e1mqe12VGww+MEE=
>Message-ID: <8ea2ac2004120211406650777b@...l.gmail.com>
>Date: Thu, 2 Dec 2004 20:40:21 +0100
>From: Emile van Elen <emile.van.elen@...il.com>
>Reply-To: Emile van Elen <emile.van.elen@...il.com>
>To: bugtraq@...urityfocus.com
>Subject: Advanced Guestbook
>Mime-Version: 1.0
>Content-Type: text/plain; charset=US-ASCII
>Content-Transfer-Encoding: 7bit
>
>There's a XSS in Advanced Guestbook 2.3.1
>
>For example:
>
>index.php?entry=&lt;script&gt;alert(document.cookie)&lt;/script&gt;
>
>
>greetings,
>-- 
>Emile van Elen
>