bugtraq - Orplex guestbook script injection.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 7 Apr 2003 13:01:13 +0400
From: "drG4njubas" <drG4nj@...l.ru>
To: <bugtraq@...urityfocus.com>
Subject: Orplex guestbook script injection.

This advisory and other useful files can
be found at http://www.blacktigerz.org

Date:
07.04.2003

Subject:
Orplex guestbook script injection.

Description:
Free asp guestbook. Main fetures are:inserting 
smiles as icons; web-based administration; bad word 
filtering.

Vendor:
Orplex consulting inc.
http://www.orplex.com

Vulnerability:
addentry.asp neglects filtering user input allowing 
for script injection to the guestbook via "Name" 
and "Massage" fields. The injected script will be 
executed in anyones browser who visits the guestbook.

Black Tigerz Research Group
We are:Areus,Barracuda,n1Tr0f4n,Velzevol,drG4njubas.
Please visit our website: http://www.blacktigerz.org