advisory-realGuestbook_V5-en.txt

`--------------------------------------------------------  
realGuestbook_V5 Script Injection Vulnerability |  
Discovered by Trew | ICEnetX Team http://icenetx.net |  
http://trew.icenetx.net [email protected] |  
--------------------------------------------------------  
  
Date: 17 march 2007  
Vendor URL: http://realscripts.de  
Risk: Medium  
Satatus: Unpatched  
  
## Vulnerability ##  
  
realGuestbook_V5 is a German Guestbook system. This guestbooks may allow an attacker to inject code into the page. The injection is achieved through injecting code into the homepage field, some administrators decide to delete this field, but the original version of the aplication includes this field.   
  
The vulnerability is located in the page where comments are sent (default: add_entry.php). This is the  
vulnerable field:  
  
<input type="text" name="hoempage" style="width:100%" value=" INYECTION GOES HERE ">  
  
The 'homepage' variable is not santized correctly, so code can be injected by breaking the link tag generated in  
guestbook.php, by writting the characters "> at the beggining of the URL field.  
  
Attack example:  
  
URL value: url = http://trew.icenetx.net  
Result in guestbook.php: <a href="http://trew.icenetx.net">...  
  
URL value: url = "><h1>HACKED</h1>  
Resultin guestbook.php: <a href=""><h1>HACKED</h1> ...  
  
## How to fix ##  
  
Filter or delete the URL field at add_entry.php  
  
-----  
"Maybe you can't break the system, but you can always hack it."  
http://trew.icenetx.net [email protected]  
`