.:. MicroGuestBook Remote XSS Bug .:. Date: ----- July 2006, 22 Product: -------- MicroGuestBook Latest Version Vendor: ------- http://www.phptoys.com Description: ------------ Micro guestbook is a MySQL based guestbook script with a CSS based attractive interface. It can store the name, date, message, location, web and email information of the visitor. Exploit(s)/Advisory(ies): ------------------------- The application is vulnerable to a Remote XSS Bug. The field 'name' and 'comment' are not properly sanitized before being used, so a malicious people can exploit this vulnerability to inject arbitrary HTML and script code. If you look the code in add.php you can see: [...] if (isset($_POST['submitBtn'])) { $name = (isset($_POST['name'])) ? $_POST['name'] : '' ; $comment = (isset($_POST['comment'])) ? $_POST['comment'] : '' ; $location = (isset($_POST['location'])) ? $_POST['location'] : '' ; $website = (isset($_POST['website'])) ? $_POST['website'] : '' ; $email = (isset($_POST['email'])) ? $_POST['email'] : '' ; $actDate = date("Y-m-d H:i:s"); //Minimum name and comment length. if ((strlen($name) > 2) && (strlen($comment) > 5)){ $sql = "INSERT INTO guestbook (name,text,insertdate,location,web,email) VALUES ("; $sql .= "'".$name."','".$comment."','".$actDate."','".$location."','".$website." ','".$email."')"; $MyDb->f_ExecuteSql($sql); [...] And in index.php you will see: [...] <div id="name"><?php echo $row['name']; ?></div> <div id="info"> <div id="infoicons"> <?php if (strlen($row['web']) > 5) echo '<a href="http://'.$row['web'].'"><img src="style/www.gif"></a>'; if (strlen($row['email']) > 5) echo '<a href="mailto:'.$row['email'].'"><img src="style/mail.gif"></a>'; ?> </div> <div id="infodate"><?php echo $row['insertdate']; ?></div> </div> </div> <div id="base"> <div id="icon"><?php echo $row['location']; ?></div> <div id="text"><?php echo nl2br($row['text']); ?></div> [...] PoC(s): ------- You can put your own HTML or script code in the field name or comment. Try: <script>alert("XSS")</script> Vendor Status: -------------- [July 2006, 22] Vendor contacted! Patches: -------- [July 2006, 22] At the moment there is no patch available from the vendor. You can take a look at this site if a patch will be posted up: http://www.phptoys.com If you don't wanna wait, edit the source code to ensure that input is properly sanitised. Credits: -------- omnipresent omnipresent[at]email[dot]it http://it.security.netsons.org