PT-2003-2186 · Myguestbook · Myguestbook

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1241

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyGuestbook version 3.0

Description A cross-site scripting vulnerability (XSS) exists in MyGuestbook, allowing remote attackers to execute arbitrary PHP code. This is achieved by modifying the location parameter to reference a URL on a remote web server that contains file.php via script injected into the pseudo, email, and message parameters in several PHP files, including admin index.php, admin pass.php, admin modif.php, and admin suppr.php.

Recommendations For MyGuestbook version 3.0, update the software to a version that includes a fix for this issue, ensuring that the pseudo, email, and message parameters are properly sanitized to prevent script injection. As a temporary workaround, consider restricting access to the admin index.php, admin pass.php, admin modif.php, and admin suppr.php files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2003-1241

Affected Products

Myguestbook

References · 4

• 🔥 http://securityfocus.com/archive/1/312762 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0089.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1241 · Security Note
• http://securityfocus.com/bid/6906 · Note