header-logo
Suggest Exploit
vendor:
GuppY
by:
SecurityFocus
3.3
CVSS
LOW
HTML Injection
79
CWE
Product Name: GuppY
Affected Version From: 2.4
Affected Version To: 2.4p1
Patch Exists: YES
Related CWE: N/A
CPE: a:guppy:guppy
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

GuppY HTML Injection Vulnerability

It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, 'postguest.php', does not perform input validation to prevent the inclusion of HTML/script content in messages posted to the portal by remote clients. The flaw is present in the implementation of the '[c]' tag, which can be used by users posting messages in the forum or in the guestbook components of GuppY portals. An example of the exploit is '[c=expression(alert('unsecure'))]texte[/c]'.

Mitigation:

The vendor is aware of the vulnerability and has released an updated version, 2,4p1, that eliminates the issue.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8717/info

It has been reported that one of the scripts included with GuppY is vulnerable to an HTML injection attack. The script, "postguest.php", does not perform input validation to prevent the inclusion of HTML/script content in messages posted to the portal by remote clients. The flaw is present in the implementation of the "[c]" tag, which can be used by users posting messages in the forum or in the guestbook components of GuppY portals.

The vendor is aware of the vulnerability and has released an updated version, 2,4p1, that eliminates the issue. 

[c=expression(alert('unsecure'))]texte[/c]

Navigation

Suggest Exploit

Services By CQR