Home page logo

bugtraq logo Bugtraq mailing list archives

CGI-City's CCGuestBook Script Injection Vulns
From: "BrainRawt ." <brainrawt () hotmail com>
Date: Sat, 29 Mar 2003 18:47:04 +0000

CGI-City's CCGuestBook Script Injection Vulnerabilities
Discovered By BrainRawt (brainrawt () hotmail com)

About CCGuestBook:
CC Guestbook is a simple guestbook program that is very easy
to configure and install. It features a notification facility
which sends an email alert to the guestbook owner whenever new
entries are made. It may also be used as a post-it board to
allow visitors to a web site to just post messages.

CCGuestBook can be downloaded from the following address.


Vendor Contact:
1-30-03 Emailed cgicity () icthus net

No Response

cc_guestbook.pl neglects filtering user input allowing for script
injection to the guestbook via "name" and "webpage title".  The
injected script will be executed in anyones browser who visits
the guestbook.

Exploit (POC):

Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

  By Date           By Thread  

Current thread:
  • CGI-City's CCGuestBook Script Injection Vulns BrainRawt . (Mar 29)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]