medium4.3Public exploit code
CVE-2008-7140
Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- @lex Guestbook 4.0.5 - 'index.php?test' Cross-Site Scripting2008-03-31 · webapps · php · Verified
- @lex Guestbook 4.0.5 - 'setup.php?language_setup' Cross-Site Scripting2008-03-31 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: a third party has been reported that the test parameter is not used in @lex Guestbook.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alexguestbook | \@Lex Guestbook | through 4.0.5 Versions 3.12, 3.13, 4.0.1, 4.0.2, 4.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://downloads.securityfocus.com/vulnerabilities/exploits/28519.html
- http://www.juniper.net/security/auto/vulnerabilities/vuln28519.html
- http://www.securityfocus.com/bid/28519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41566
- http://downloads.securityfocus.com/vulnerabilities/exploits/28519.html
- http://www.juniper.net/security/auto/vulnerabilities/vuln28519.html
- http://www.securityfocus.com/bid/28519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41566