Title: AN Guestbook Unspecified Cross-Site Scripting Vulnerabilities
Severity: MODERATE
Description:
AN Guestbook (ANG) is a web-based guestbook application. It is implemented in PHP and MySQL.
AN Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input to unspecified parameters.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
No further technical details are currently available. We will update this BID as more information emerges.
Versions prior to AN Guestbook 0.7.6 are vulnerable.
Affected Products:
- AN Guestbook AN Guestbook 0.4
- AN Guestbook AN Guestbook 0.7
- AN Guestbook AN Guestbook 0.7.5
References:
- AN Guestbook: AN Guestbook Homepage
- AN Guestbook: Version 0.7.6 released