source: https://www.securityfocus.com/bid/13632/info
Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted messages.
The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible. A victim user who views the vulnerable sections of the site would have the attacker-supplied HTML and script code execute in the security context of the affected site.
Skull-Splitter Guestbook versions 1.0, 2.0, and 2.2 have been reported to be vulnerable, however, other versions may be affected as well.
1. Type in the title or content of msg
Type in the title or content of msg
2.