advisory-php-gaestebuch-en.txt

`--------------------------------------------------------  
PHP-Gaestebuch v1.63 Script Injection Vulnerability |  
Discovered by Trew | ICEnetX Team http://icenetx.net |  
http://trew.icenetx.net [email protected] |  
--------------------------------------------------------  
  
Date: 04 marzo 2007  
Vendor URL: http://www.php-gaestebuch.de/  
Risk: Medium  
Satatus: Unpatched  
Vulnerable versions: v6.3 and earlier  
  
## Vulnerability ##  
  
Php-Gaestebuch is a German Guestbook system. This guestbooks may allow an attacker to inject code into the page. The  
vulnerable versions are the 6.3 (most recent) and earliers. The injection is achieved through injecting code into the URL  
field, some administrators decide to delete this field, but the original version of the aplication includes this field.   
  
The vulnerability is located in the page where comments are sent (default: guestbook_newentry.php). This is the  
vulnerable field:  
  
<input id="gbinput" type="text" name="url" size="40" value="INJECTION-GOES-HERE" tabIndex="3">  
  
The 'URL' variable is not santized correctly, and so code can be injected breaking the link tag generated in  
guestbook.php, by writting the characters "> at the beggining of the URL field.  
  
Attack example:  
  
URL value: url = http://trew.icenetx.net  
Result in guestbook.php: <a href="http://trew.icenetx.net">...  
  
URL value: url = "><h1>HACKED</h1>  
Resultin guestbook.php: <a href=""><h1>HACKED</h1> ...  
  
## How to fix ##  
  
Filter or delete the URL field at guestbook_newentry.php  
  
-----  
"Maybe you can't break the system, but you can always hack it."  
http://trew.icenetx.net [email protected]  
`