Orplex guestbook script injection.

["drG4njubas" <drG4nj () mail ru>]

This advisory and other useful files can
be found at http://www.blacktigerz.org


Date:
07.04.2003

Subject:
Orplex guestbook script injection.

Description:
Free asp guestbook. Main fetures are:inserting 
smiles as icons; web-based administration; bad word 
filtering.

Vendor:
Orplex consulting inc.
http://www.orplex.com

Vulnerability:
addentry.asp neglects filtering user input allowing 
for script injection to the guestbook via "Name" 
and "Massage" fields. The injected script will be 
executed in anyones browser who visits the guestbook.


Black Tigerz Research Group
We are:Areus,Barracuda,n1Tr0f4n,Velzevol,drG4njubas.
Please visit our website: http://www.blacktigerz.org