PT-2007-2720 · Sava · Sava'S Guestbook

CVE-2007-1305 · Published 2007-03-07 · Updated 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sava's Guestbook version 23.11.2006

Description The issue allows remote attackers to inject arbitrary web script or HTML via the name, country, email, and website parameters in the add2.php file. This can lead to cross-site scripting (XSS) attacks.

Recommendations For Sava's Guestbook version 23.11.2006, consider validating and sanitizing user input for the name, country, email, and website parameters to prevent XSS attacks. As a temporary workaround, restrict access to the add2.php file until a proper fix is applied.

Fix

Related Identifiers

CVE-2007-1305

Affected Products

Sava'S Guestbook

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-1305 · Security Note
• http://securityreason.com/securityalert/2350 · Note
• http://securityfocus.com/bid/22820 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32812 · Note
• http://secunia.com/advisories/24411 · Note
• http://belsec.com/advisories/142/summary.html · Note
• http://securityfocus.com/archive/1/461910/100/0/threaded · Note