GuppY 2.4 HTML Injection Vulnerability

2003-09-29T00:00:00
ID EDB-ID:23192
Type exploitdb
Reporter David Suzanne
Modified 2003-09-29T00:00:00

Description

GuppY 2.4 HTML Injection Vulnerability. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/8717/info

It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, "postguest.php", does not perform input validation to prevent the inclusion of HTML/script content in messages posted to the portal by remote clients. The flaw is present in the implementation of the "[c]" tag, which can be used by users posting messages in the forum or in the guestbook components of GuppY portals.

The vendor is aware of the vulnerability and has released an updated version, 2,4p1, that eliminates the issue. 

[c=expression(alert('unsecure'))]texte[/c]