A vulnerability has been identified in GuestBookHost, which can be exploited by malicious people to conduct Cross-Site Scripting attacks against other users.

The vulnerability is caused due to missing validation of user input supplied in various fields ("Name", "Email", and "Message") when signing the guest book. A malicious person can exploit this to execute arbitrary script code in a user's browser session, when a malicious post is viewed.

Successful exploitation can result in disclosure of various information (eg. cookie-based authentication information) associated with the site running GuestBookHost or inclusion of malicious content, which the user thinks is part of the real website.

Solution
Use another product, or filter malicious characters in a HTTP proxy or firewall with URL filtering capabilities.

Provided and/or discovered by
Julien LANTHEA

Deep Links
Links available to Secunia VIM customers