Multiple cross-site scripting (XSS) vulnerabilities in myPHP Guestbook 1.x through 2.0.0-r1 and before 2.0.1 RC5 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) email, (3) homepage, (4) id, (5) name, and (6) text parameters in (a) index.php, the (7) comment, (8) email, (9) homepage, (10) number, (11) name, and (12) text parameters in (b) admin/guestbook.php, and the (13) email, (14) homepage, (15) icq, (16) name, and (17) text parameters in (c) admin/edit.php.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Myphp_guestbook | Myphp_guestbook | 1.0 (including) | 1.0 (including) |
| Myphp_guestbook | Myphp_guestbook | 1.8 (including) | 1.8 (including) |
| Myphp_guestbook | Myphp_guestbook | 1.8.3 (including) | 1.8.3 (including) |
| Myphp_guestbook | Myphp_guestbook | 1.9 (including) | 1.9 (including) |
| Myphp_guestbook | Myphp_guestbook | 1.9.2 (including) | 1.9.2 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0 (including) | 2.0.0 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0-r1 (including) | 2.0.0-r1 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0_alpha (including) | 2.0.0_alpha (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0_beta (including) | 2.0.0_beta (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0_rc1 (including) | 2.0.0_rc1 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0_rc2 (including) | 2.0.0_rc2 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0_rc3 (including) | 2.0.0_rc3 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.0_rc4 (including) | 2.0.0_rc4 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.1_beta (including) | 2.0.1_beta (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.1_rc1 (including) | 2.0.1_rc1 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.1_rc2 (including) | 2.0.1_rc2 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.1_rc3 (including) | 2.0.1_rc3 (including) |
| Myphp_guestbook | Myphp_guestbook | 2.0.1_rc4 (including) | 2.0.1_rc4 (including) |
References
- http://secunia.com/advisories/20764
- http://www.networkarea.ch/forum/topic.php?id=4\u0026s=9106beea248ecd1a552439168ada227e
- http://www.securityfocus.com/bid/18582
- http://www.vupen.com/english/advisories/2006/2480
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27293
- http://secunia.com/advisories/20764
- http://www.networkarea.ch/forum/topic.php?id=4\u0026s=9106beea248ecd1a552439168ada227e
- http://www.securityfocus.com/bid/18582
- http://www.vupen.com/english/advisories/2006/2480
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27293