PerlBlog Multiple Input Validation and Information Disclosure Vulnerabilities
BID:16707
Info
PerlBlog Multiple Input Validation and Information Disclosure Vulnerabilities
| Bugtraq ID: | 16707 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 17 2006 12:00AM |
| Updated: | Mar 01 2006 06:46PM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
PerlBLOG PerlBLOG 1.09b PerlBLOG PerlBLOG 1.09 PerlBLOG PerlBLOG 1.08 |
| Not Vulnerable: | |
Discussion
PerlBlog Multiple Input Validation and Information Disclosure Vulnerabilities
PerlBlog is prone to multiple input-validation and information-disclosure vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit these issues to execute arbitrary attacker-supplied HTML and script code in the browser of a victim user, read arbitrary '.txt' files, and create arbitrary files on the affected computer, all in the context of the webserver process.
Successful exploitation of these issues may allow an attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, to retrieve sensitive information, and to execute arbitrary script code in the context of the webserver process; other attacks are also possible.
PerlBlog is prone to multiple input-validation and information-disclosure vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit these issues to execute arbitrary attacker-supplied HTML and script code in the browser of a victim user, read arbitrary '.txt' files, and create arbitrary files on the affected computer, all in the context of the webserver process.
Successful exploitation of these issues may allow an attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, to retrieve sensitive information, and to execute arbitrary script code in the context of the webserver process; other attacks are also possible.
Exploit / POC
PerlBlog Multiple Input Validation and Information Disclosure Vulnerabilities
An exploit is not required.
An exploit is not required.
Solution / Fix
PerlBlog Multiple Input Validation and Information Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
PerlBlog Multiple Input Validation and Information Disclosure Vulnerabilities
References:
References:
- PerlBLOG Homepage (PerlBLOG)
- PerlBlog Multiple Vulnerabilities (eVuln)
- [eVuln] PerlBlog Multiple Vulnerabilities (eVuln)