bugtraq - MJGuest 6.8 GT Cross Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 29 Jul 2008 20:33:41 -0000
From: irancrash@...il.com
To: bugtraq@...urityfocus.com
Subject: MJGuest 6.8 GT Cross Site Scripting Vulnerability

----------------------------------------------------------------

Script : MJGuest 6.8 GT

Type : Cross Site Scripting Vulnerability

Alert : Medium

----------------------------------------------------------------

Discovered by : Khashayar Fereidani

Our Team : IRCRASH

My Official Website : HTTP://FEREIDANI.IR

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t] com

----------------------------------------------------------------

Khashayar Fereidani Offical Website : HTTP://FEREIDANI.IR

----------------------------------------------------------------

Script Download : http://www.mdsjack.bo.it/files/mjguest_6.8gt.zip

----------------------------------------------------------------
XSS Vulnerability :

Invalid Code : ./guestbook.js.php => document.write('<a href="javascript:guestbook()">' + '<?php echo $_GET['link']?>' + '</a>');

Vulnerable variable : link

Address : http://Example/guestbook.js.php?link=[XSS]

Solution : Filter link variable with htmlsepcialchars() function .

----------------------------------------------------------------

                        Tnx : God

                     HTTP://IRCRASH.COM

----------------------------------------------------------------