From:	 Ahmet Sabri ALPER <s_alper@hotmail.com>
To:	 bugtraq@securityfocus.com
Subject: [ARL02-A08] BG Guestbook Cross Site Scripting Vulnerability
Date:	 16 Mar 2002 23:10:03 -0000



+/--------\-------- ALPER Research Labs ------/--------/+
+/---------\-------  Security Advisory  -----/---------/+
+/----------\------    ID: ARL02-A08    ----/----------/+
+/-----------\----- salper@olympos.org  ---/-----------/+


Advisory Information
--------------------
Name               : BG Guestbook Cross Site Scripting 
Vulnerability
Software Package   : BG Guestbook
Vendor Homepage    : http://billyg.no-
ip.com:8080/bggb/
Vulnerable Versions: v1.0
Platforms          : PHP & MySQL dependent
Vulnerability Type : Input Validation Error
Vendor Contacted   : 15/03/2002
Vendor Replied     : waiting for reply (5 days left)
Prior Problems     : N/A
Current Version    : v1.1 (immune)


Summary
-------
BG GuestBook a php guestbook that utilizes mysql,  
has a Macromedia Flash interface and is also 
capable of using HTML only, where Flash is not 
supported. 

A Cross Site Scripting vulnerability exists in BG 
GuestBook. This would allow a remote attacker to 
send information to victims from untrusted web 
servers, and make it look as if the information 
came from the legitimate server.


Details
-------
Both the Flash and HTML only versions are 
vulnerable to Cross Site Scripting attacks.
All of the input fields (including name, email, AIM, 
location, website and message) in the posting form 
are vulnerable to this type of attack.


Example input to any of the above fields:
&lt;script&gt;alert("ALPERz was here!")&lt;/script&gt;

After submitting this information, whenever anyone 
browses the guestbook's main page, the script will 
take effect.


Solution
--------
The vendor confirmed the vulnerability and released a 
new version on the same day of the bug's discovery.

I suggested the following as a workaround:
Strip HTML tags, and possibly other malicious code 
within "signgbook.php".
I suggest the following as a workaround;
At the beginning of "signgbook.php" add the lines 
below;

# Patch Start
$name= strip_tags ($name);
$email= strip_tags ($email);
$aimscr= strip_tags ($aimscr);
$website= strip_tags ($website);
$loc= strip_tags ($loc);
$msg= strip_tags ($msg);
# Patch End


Credits
-------
Discovered on 15, March, 2002 by 
Ahmet Sabri ALPER 
salper@olympos.org
http://www.olympos.org


References
----------
Product Web Page: http://billyg.no-ip.com:8080/bggb/