This advisory and other useful files can
be found at http://www.blacktigerz.org


Date:
07.04.2003

Subject:
Orplex guestbook script injection.

Description:
Free asp guestbook. Main fetures are:inserting
smiles as icons; web-based administration; bad word
filtering.

Vendor:
Orplex consulting inc.
http://www.orplex.com

Vulnerability:
addentry.asp neglects filtering user input allowing
for script injection to the guestbook via "Name"
and "Massage" fields. The injected script will be
executed in anyones browser who visits the guestbook.


Black Tigerz Research Group
We are:Areus,Barracuda,n1Tr0f4n,Velzevol,drG4njubas.
Please visit our website: http://www.blacktigerz.org