EV0134.txt

`New eVuln Advisory:  
Doika guestbook 'page' XSS Vulnerability  
http://evuln.com/vulns/134/summary.html  
  
--------------------Summary----------------  
eVuln ID: EV0134  
CVE: CVE-2006-4325  
Software: Doika guestbook  
Sowtware's Web Site: http://doika.net/  
Versions: 2.5  
Critical Level: Harmless  
Type: Cross-Site Scripting  
Class: Remote  
Status: Unpatched. No reply from developer(s)  
PoC/Exploit: Available  
Solution: Not Available  
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)  
  
-----------------Description---------------  
Cross-Site Scripting.   
  
Vulnerable Script: gbook.php   
  
Parameter page is not properly sanitized. This can be used to post  
arbitrary HTML or web script code.   
  
  
--------------PoC/Exploit----------------------  
Available at: http://evuln.com/vulns/134/exploit.html  
  
  
Cross-Site Scripting Example:  
  
URL: http://[host]gbook.php? id=new  
  
new entry:  
url: http://host/" onmouseover="alert(123)  
  
--------------Solution---------------------  
No Patch available.  
  
--------------Credit-----------------------  
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)  
  
  
Regards,  
Aliaksandr Hartsuyeu  
http://evuln.com - Penetration Testing Services  
.  
  
`