CVE-2009-2104

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Modern Guestbook / Commenting System (ve_guestbook) extension for TYPO3, affecting versions 2.7.1 and earlier. The flaw occurs through unspecified vectors, allowing an attacker to inject arbitrary web script or HTML [1]. Details on the affected component or parameter have not been publicly disclosed in the available references.

Exploitation

To exploit this vulnerability, an attacker must be able to provide crafted input to the guestbook or commenting functionality of a TYPO3 site using the affected extension. No authentication is mentioned as a prerequisite; the attack likely requires no special privileges beyond the ability to submit content. The unspecified nature of the vectors means the exact attack surface is not known from the available references [1].

Impact

Successful exploitation allows an attacker to execute arbitrary HTML and JavaScript in the context of the victim's browser when the victim views the injected content. This can lead to session hijacking, defacement, or redirection to malicious sites. The impact is typical of stored XSS, potentially affecting any user who accesses the compromised guestbook or comment pages.

Mitigation

The vulnerability is patched in version 2.7.2 of the ve_guestbook extension, available from the TYPO3 extension repository [1]. Users of versions 2.7.1 and earlier should upgrade to 2.7.2 or later. No other workaround is mentioned in the provided references.