GuppY 2.4 - Cross-Site Scripting

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054215 漏洞类型
发布时间 2003-10-05 更新时间 2003-10-05
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/23219
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/8768/info

GuppY is reported to be prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the postguest module of the software. This issue may allow a remote attacker to execute HTML or script code in user's browser.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks may also be possible. 

- [l]" style="background:url('javascript:[SCRIPT]');visibility:hidden;[/l]

- [l][l] style=list-style:url(javascript:[SCRIPT]) truc=[/l][/l]

- With a cookie named "GuppYUser" and with the value :
fr||[NICK]||[MAIL]||LR||||on||<br
style="background:url('javascript:[SCRIPT]')">, if you send a message
(forum, guestbook,...) the javascript is executed.