Description
An open redirect vulnerability exists in interface/redirect.htm.php of Mjguest 6.7 GT Rev.01. The goto parameter of a redirect action to mjguest.php is used as the redirect target without checking that it points to the local site, so any URL is accepted.
Impact
An attacker can send a link that starts on the trusted guestbook host and ends on a site under their control, which makes phishing pages look legitimate. The redirect shows a notice and a short delay first, so the attack needs the user to wait or to click through.
Solution
Accept only relative paths, or check the goto value against a list of allowed hosts before redirecting.