vendor:
by:
Gammarays
7.5
CVSS
HIGH
Remote Code Execution
94
CWE
Product Name:
Affected Version From: LS simple guestbook (v1)
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
LS simple guestbook Remote Code Execution
LS simple guestbook fails to sanitize user input that it writes to the posts.txt file when the user leaves a message, this file is then included causing any php code within it to be run.
Mitigation:
Add the following line of code in index.php:$message = strip_tags($message);just above:if ($message != "') {$file = fopen("$dataf","a");
