--------------------------------------------------------
 PHP-Gaestebuch  v1.63 Script Injection Vulnerability  |
  Discovered by Trew | ICEnetX Team http://icenetx.net |
http://trew.icenetx.net     trew.revolution@gmail.com   |
--------------------------------------------------------

Date: 04 marzo 2007
Vendor URL: http://www.php-gaestebuch.de/
Risk: Medium
Satatus: Unpatched
Vulnerable versions:  v6.3 and earlier

## Vulnerability ##

Php-Gaestebuch is a German Guestbook system. This guestbooks may allow an attacker to inject code into the page. The
vulnerable versions are the 6.3 (most recent) and earliers. The injection is achieved through injecting code into the URL
field, some administrators decide to delete this field, but the original version of the aplication includes this field. 

The vulnerability is located in the page where comments are sent (default: guestbook_newentry.php). This is the
vulnerable field:

<input id="gbinput" type="text" name="url" size="40" value="INJECTION-GOES-HERE" tabIndex="3">

The 'URL' variable is not santized correctly, and so code can be injected breaking the link tag generated in
guestbook.php, by writting the characters "> at the beggining of the URL field.

Attack example:

URL value:        url = http://trew.icenetx.net
Result in guestbook.php:   <a href="http://trew.icenetx.net">...

URL value:         url = "><h1>HACKED</h1>
Resultin guestbook.php:    <a href=""><h1>HACKED</h1> ...

## How to fix ##

Filter or delete the URL field at guestbook_newentry.php

-----
"Maybe you can't break the system, but you can always hack it."
  http://trew.icenetx.net    trew.revolution@gmail.com