Advanced Guestbook 2.2/2.3 – User-Agent HTML Injection

漏洞ID	1054866	漏洞类型
发布时间	2005-01-22	更新时间	2005-01-22
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	Windows	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/26035

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/14391/info

Advanced Guestbook is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

Set the following registry setting to exploit this vulnerability:
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Internet Settings/5.0/User Agent/] (Default)= "Code to inject"

相关推荐: X-CD-Roast Local Insecure File Creation Symlink Vulnerability

X-CD-Roast Local Insecure File Creation Symlink Vulnerability 漏洞ID 1099287 漏洞类型 Access Validation Error 发布时间 2003-11-04 更新时间 2003-…