header-logo
Suggest Exploit
vendor:
Guestbook
by:
5.5
CVSS
MEDIUM
Cross-Site Scripting (XSS)
79
CWE
Product Name: Guestbook
Affected Version From: 4.00 beta
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

212Cafe Guestbook Cross-Site Scripting Vulnerability

The 212Cafe Guestbook application fails to properly sanitize user-supplied input, leading to a cross-site scripting vulnerability. An attacker can exploit this vulnerability by injecting arbitrary script code into the affected site, which can then be executed in the browser of an unsuspecting user. This allows the attacker to potentially steal authentication credentials and launch further attacks.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize and validate user-supplied input before displaying it on web pages. Implementing a web application firewall (WAF) can also help in preventing XSS attacks. Regularly updating the application to the latest version can also address any security vulnerabilities.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/22173/info

212Cafe Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 4.00 beta is vulnerable; other versions may also be affected. 

http://www.example.com/guestbookv4.0/show.php?user='><script>alert(document.cookie);</script>

Navigation

Suggest Exploit

Services By CQR