This advisory nd other useful files can be found at www.blacktigerz.org Subject: SignHere guestbook vulnerability. Description: Free, easy-to-use guestbook. Main features are: message text formatting (bold text, urls etc.); inserting smiles as icons; web-based administration; email notifications about new posts. Also html output is optimized to maximize download speed. Vendor: Bitstrike software. http://www.bitstrike.com Vulnerability: Default.asp neglects filtering user input allowing for script injection to the guestbook via "Email" field. The injected script will be executed in anyones browser who visits the guestbook. ____________________________ Best Regards, drG4njubas Black Tigerz Research Group http://www.blacktigerz.org
This archive was generated by hypermail 2b30 : Sat Apr 05 2003 - 08:52:26 PST