Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2006-2771: Hogstorp Guestbook 2.0 lets anyone delete posts
CVE-2006-2771 · published 20 years ago
Summary
The guestbook version 2.0 does not check who is making a request to the delete page, so a remote user can craft a URL that removes any message. This can be used to erase content or disrupt the guestbook. Apply the vendor’s update or restrict access to the delete page until a fix is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hogstorps | hogstorp_guestbook |
2.0 cpe:2.3:a:hogstorps:hogstorp_guestbook:2.0:*:*:*:*:*:*:* |
Original advisory text
admin/radera/tabort.asp in Hogstorps hogstorp guestbook 2.0 does not verify user credentials, which allows remote attackers to delete arbitrary posts via a modified delID parameter.
admin/radera/tabort.asp in Hogstorps hogstorp guestbook 2.0 does not verify user credentials, which allows remote attackers to delete arbitrary posts via a modified delID parameter.
References
- http://colander.altervista.org/advisory/HTGuestBook2.txt Exploit Vendor Advisory
- http://secunia.com/advisories/20402 Exploit Vendor Advisory
- http://www.securityfocus.com/bid/18205 Exploit
- http://www.vupen.com/english/advisories/2006/2082
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26979
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
6.4
Medium
Timeline
Published2 Jun 2006
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-2771 · NVD
Track software like this
Free during beta