GuppY Cross-Site Scripting Vulnerability

vendor:

GuppY

by:

SecurityFocus

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: GuppY

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

GuppY Cross-Site Scripting Vulnerability

GuppY is reported to be prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the postguest module of the software. This issue may allow a remote attacker to execute HTML or script code in user's browser. Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks may also be possible.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8768/info

GuppY is reported to be prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the postguest module of the software. This issue may allow a remote attacker to execute HTML or script code in user's browser.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks may also be possible. 

- [l]" style="background:url('javascript:[SCRIPT]');visibility:hidden;[/l]

- [l][l] style=list-style:url(javascript:[SCRIPT]) truc=[/l][/l]

- With a cookie named "GuppYUser" and with the value :
fr||[NICK]||[MAIL]||LR||||on||<br
style="background:url('javascript:[SCRIPT]')">, if you send a message
(forum, guestbook,...) the javascript is executed.