CVE-2021-47950
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface. Authenticated attackers can inject malicious scripts by manipulating the s_emotion parameter. The script executes when administrators view the smilies tab.
Risk Assessment
The risk involves potential session hijacking, data theft, or unauthorized actions within the admin panel. Although authentication is required, the vulnerability can lead to privilege escalation.
Recommendation
Immediately upgrade Advanced Guestbook to the latest available version. If upgrading is not possible, restrict admin panel access to trusted users and validate input in the s_emotion parameter.
Original NVD description (English source)
Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers to inject malicious scripts by manipulating the s_emotion parameter. Attackers can submit POST requests to admin.php with JavaScript code in the s_emotion field, which executes when administrators view the smilies tab.