/* -------------------------------------------------------- [N]eo [S]ecurity [T]eam [NST]? - Advisory #23 - 07/07/06 -------------------------------------------------------- Program: PBL Guestbook Homepage: www.pixelatedbylev.com Vulnerable Versions: 1.32 and lower. Risk: High! Impact: Critical Risk -==PBL Guestbook <= 1.32 XSS & SQL Querys Vulnerabilities==- --------------------------------------------------------- - Description --------------------------------------------------------- PBL Guestbook fully functional guestbook loaded with tons of features and packed for premium optimization and performance. - Tested --------------------------------------------------------- PBL Homepage & other sites - Explotation --------------------------------------------------------- 1) Vulnerable code: ==[ pblguestbook.php 164-183 ]========================== [...] if ($id){ foreach ($_POST as $name => $value) { $_POST["$name"] = str_replace("\n","
",$value); } foreach ($_POST as $name => $value) { $_POST["$name"] = str_replace("\t","",$value); } foreach ($_POST as $name => $value) { $_POST["$name"] = str_replace("\r","",$value); } foreach ($_POST as $name => $value) { $_POST["$name"] = str_replace('|',"¦",$value); } foreach ($_POST as $name => $value) { $_POST["$name"] = preg_replace("/\(.*?)\<\/SCRIPT(.*?)\>/i", "SCRIPT BLOCKED", $value); } [...] ==[ end pblguestbook.php ]========================== How we can see the script only do some replaces. Only the