--------------------------------------------------------
 realGuestbook_V5      Script Injection Vulnerability  |
  Discovered by Trew | ICEnetX Team http://icenetx.net |
http://trew.icenetx.net     trew.revolution@gmail.com   |
--------------------------------------------------------

Date: 17 march 2007
Vendor URL: http://realscripts.de
Risk: Medium
Satatus: Unpatched

## Vulnerability ##

realGuestbook_V5 is a German Guestbook system. This guestbooks may allow an attacker to inject code into the page. The injection is achieved through injecting code into the homepage field, some administrators decide to delete this field, but the original version of the aplication includes this field. 

The vulnerability is located in the page where comments are sent (default: add_entry.php). This is the
vulnerable field:

<input type="text" name="hoempage" style="width:100%" value=" INYECTION GOES HERE ">

The 'homepage' variable is not santized correctly, so code can be injected by breaking the link tag generated in
guestbook.php, by writting the characters "> at the beggining of the URL field.

Attack example:

URL value:      url = http://trew.icenetx.net
Result in guestbook.php:   <a href="http://trew.icenetx.net">...

URL value:       url = "><h1>HACKED</h1>
Resultin guestbook.php:    <a href=""><h1>HACKED</h1> ...

## How to fix ##

Filter or delete the URL field at add_entry.php

-----
"Maybe you can't break the system, but you can always hack it."
  http://trew.icenetx.net    trew.revolution@gmail.com