MPM Guestbook, "a simple guestbook with multi-language support", allows remote attacker to inject arbitrary HTML and/or JavaScript into the web page and to cause the product to disclose the directory under which it was installed.
The vulnerabilities are caused due to missing validation of input supplied to the "lng" parameter. Whenever an invalid "lng" parameter is provided, an error page is returned with the parameter (unfiltered). This can be exploited to cause the page to include arbitrary HTML and/or JavaScript, which will be executed in the user's browser session. The vulnerability will allow you to reveal the path under which the program has been installed.
