guestbook.pl cleanses user-inserted SSI commands by removing text between separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides –>.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | 1.3.9 (including) | 1.3.9 (including) |
| Matt_wright_guestbook | Matt_wright | 2.3 (including) | 2.3 (including) |