|
Description
|
|
Multiple vulnerabilities were identified in phphg Guestbook, which could be exploited by remote attackers to bypass security restrictions, and perform SQL injection or cross site scripting attacks.
The first flaw is due to input validation errors in the "signed.php" script when processing the "location", "website" and "message" parameters, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser.
The second vulnerability is due to an input validation error in the "check.php" script that does not properly validate the "username" variable, which could be exploited by malicious people to conduct SQL injection attacks.
The third issue is due to input validation errors in the "admin/edit_smilie.php", "admin/add_theme.php", "admin/ban_ip.php", "admin/add_lang" and "admin/edit_filter" scripts that do not properly validate the "id" variable, which could be exploited by malicious people to conduct SQL injection attacks.
The fourth vulnerability is due to an error in the authentication procedure that does not properly validate the "loged", "username" and "user_level" cookie parameters, which could be exploited by attackers to gain unauthorized access to the application.
|
