--------------------------------------------------------
realGuestbook_V5 Script Injection Vulnerability |
Discovered by Trew | ICEnetX Team http://icenetx.net |
http://trew.icenetx.net trew.revolution@gmail.com |
--------------------------------------------------------
Date: 17 march 2007
Vendor URL: http://realscripts.de
Risk: Medium
Satatus: Unpatched
## Vulnerability ##
realGuestbook_V5 is a German Guestbook system. This guestbooks may allow an attacker to inject code into the page. The injection is achieved through injecting code into the homepage field, some administrators decide to delete this field, but the original version of the aplication includes this field.
The vulnerability is located in the page where comments are sent (default: add_entry.php). This is the
vulnerable field:
The 'homepage' variable is not santized correctly, so code can be injected by breaking the link tag generated in
guestbook.php, by writting the characters "> at the beggining of the URL field.
Attack example:
URL value: url = http://trew.icenetx.net
Result in guestbook.php: ...
URL value: url = ">