bugtraq - Re: Tinyguestbook XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20120103211351.GG8849@foo.fgeek.fi>
Date: Tue, 3 Jan 2012 23:13:51 +0200
From: Henri Salo <henri@...v.fi>
To: tom <tom@...net.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Tinyguestbook XSS

On Tue, Jan 03, 2012 at 08:13:32AM -0500, tom wrote:
> # Exploit Title: Tinyguestbook XSS
> # Date: 01/03/12
> # Author: G13
> # Software Link: http://code.google.com/p/tinyguestbook/
> # Category: webapps (php)
> #
> 
> ##### Vulnerability #####
> 
> There is no sanitation on the input of the msg variable. This allows
> malicious scripts to be added. This is a stored XSS
> 
> ##### Vendor Notification #####
> 
> 12/23/11 - Vendor Notified.
> 12/27/11 - Vendor email.
> 01/03/12 - No response, disclosure
> 
> ##### Affected Variables #####
> 
> Msg=[XSS]
> 
> ##### Exploit #####
> 
> The script can be added right in the page, there is no filtering of
> input.

There is also SQL-injection vulnerability, which is not critical. I still reported it to the developer: http://code.google.com/p/tinyguestbook/issues/detail?id=3

- Henri Salo