PluggedOut Blog Calendar Module Cross-Site Scripting Vulnerability
BID:10894
Info
PluggedOut Blog Calendar Module Cross-Site Scripting Vulnerability
| Bugtraq ID: | 10894 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 09 2004 12:00AM |
| Updated: | Aug 09 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to befcake beefy. |
| Vulnerable: |
PluggedOut Blog 1.60 alpha PluggedOut Blog 1.51 beta |
| Not Vulnerable: | |
Discussion
PluggedOut Blog Calendar Module Cross-Site Scripting Vulnerability
The Blog 'calendar' module does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site.
The Blog 'calendar' module does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site.
Exploit / POC
PluggedOut Blog Calendar Module Cross-Site Scripting Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
PluggedOut Blog Calendar Module Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PluggedOut Blog Calendar Module Cross-Site Scripting Vulnerability
References:
References:
- Blog Development (PluggedOut)