PT-2003-2186 · Myguestbook · Myguestbook

Publicado 2003-12-31 · Atualizado 2008-09-05 · CVE-2003-1241

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyGuestbook version 3.0

Description A cross-site scripting vulnerability (XSS) exists in MyGuestbook, allowing remote attackers to execute arbitrary PHP code. This is achieved by modifying the location parameter to reference a URL on a remote web server that contains file.php via script injected into the pseudo, email, and message parameters in several PHP files, including admin index.php, admin pass.php, admin modif.php, and admin suppr.php.

Recommendations For MyGuestbook version 3.0, update the software to a version that includes a fix for this issue, ensuring that the pseudo, email, and message parameters are properly sanitized to prevent script injection. As a temporary workaround, consider restricting access to the admin index.php, admin pass.php, admin modif.php, and admin suppr.php files to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2003-1241

Produtos afetados

Myguestbook

Referências · 4

• 🔥 http://securityfocus.com/archive/1/312762 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0089.html · Exploit
• http://securityfocus.com/bid/6906 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1241 · Nota de Segurança