EV0010.txt

`New eVuln Advisory:  
B-net Software Multiple XSS Vulnerabilities  
  
--------------------Summary----------------  
  
Software: B-net Software  
Sowtware's Web Site: http://sourceforge.net/projects/b-net/  
Versions: 1.0  
Critical Level: Moderate  
Type: Cross-Site Scripting  
Class: Remote  
Status: Unpatched  
Exploit: Available  
Solution: Not Available  
Discovered by: Aliaksandr Hartsuyeu ([email protected])  
Published: 2006.01.02  
eVuln ID: EV0010  
  
-----------------Description--------------  
Vulnerable scripts:  
shout.php  
guestbook.php  
  
Variables  
$name $shout in shout.php  
$title $message in guestbook.php  
- isn't properly sanitized. This can be used to post arbitrary html or script code which will be executed in the browser of every guestbook visitor.  
  
  
--------------Exploit---------------------  
Shoutbox:  
Name: XSS  
Website:anyurl  
Message: XSS  
  
Guestbook:  
http://192.168.10.22/temp/b-net/guestbook.php?action=sign  
Name: anyname  
Email: anyemail  
Web: anyurl  
Title: XSS  
Message: XSS  
  
--------------Solution---------------------  
No Patch available.  
  
--------------Credit---------------------  
Original Advisory:  
http://evuln.com/vulns/10/summary.html  
  
Discovered by: Aliaksandr Hartsuyeu ([email protected])  
  
`