OpenGB 1.2.3 Cross Site Scripting

2016-11-09T00:00:00
ID PACKETSTORM:139639
Type packetstorm
Reporter N_A
Modified 2016-11-09T00:00:00

Description

                                        
                                            `OpenGB version 1.2.3 Cross Site Scripting (XSS) Vulnerability  
=================================================================  
  
  
  
Discovered by N_A, N_A[at]tutanota.com  
======================================  
  
  
  
  
  
Description  
============  
  
  
A simple PHP MySQL website guestbook, user friendly and easily configurable. Features include administrator control panel, spam protection and IP address blocking. Please see http://opengb.googlecode.com for more information from the official website.  
  
  
https://sourceforge.net/projects/opengb  
  
  
  
  
Vulnerability  
==============  
  
  
OpenGB version <= 1.2.3 suffers from an XSS vulnerabilty from GET paramter 'p'.   
The input is not sanitized and it is possible to execute an XSS attack.  
  
  
  
  
  
  
  
Proof Of Concept   
=================  
  
  
http://127.0.0.1/gb/index.php?n=1&p=%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E  
  
  
  
  
Email  
======  
  
N_A[at]tutanota.com  
`