PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	10885
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 07 2004 12:00AM
Updated:	Aug 07 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to befcake beefy <[email protected]>.
Vulnerable:	PluggedOut Blog 1.60 alpha PluggedOut Blog 1.51 beta
Not Vulnerable:

PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerability

PluggedOut Blog is reported prone to a cross-site scripting vulnerability.

This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerability

The following example is available:

http://www.example.com/blog/blog_exec.php?action=remove_blog&blogid=<script>alert(document.cookie);</script>

PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PluggedOut Blog Blog_Exec.PHP Cross-Site Scripting Vulnerability

References:

• Blog Development (PluggedOut)