MJGuest 6.8 GT Cross Site Scripting Vulnerability

---

Script : MJGuest 6.8 GT

Type : Cross Site Scripting Vulnerability

Alert : Medium

---

Discovered by : Khashayar Fereidani

Our Team : IRCRASH

My Official Website : HTTP://FEREIDANI.IR

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t] com

---

Khashayar Fereidani Offical Website : HTTP://FEREIDANI.IR

---

Script Download : http://www.mdsjack.bo.it/files/mjguest_6.8gt.zip

---

XSS Vulnerability :

Invalid Code : ./guestbook.js.php => document.write('<a href="javascript:guestbook()">' + '<?php
echo $_GET['link']?>' + '</a>');

Vulnerable variable : link

Address : http://Example/guestbook.js.php?link=[XSS]

Solution : Filter link variable with htmlsepcialchars() function .

---

                    Tnx : God

                 HTTP://IRCRASH.COM

---