Insanely Simple Blog Multiple Input Validation Vulnerabilities
BID:24934
Info
Insanely Simple Blog Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 24934 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-3888 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 17 2007 12:00AM |
| Updated: | May 07 2015 05:37PM |
| Credit: | [email protected] is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Insanely Simple Blog Insanely Simple Blog 0.5 Insanely Simple Blog Insanely Simple Blog 0.4 |
| Not Vulnerable: | |
Discussion
Insanely Simple Blog Multiple Input Validation Vulnerabilities
Insanely Simple Blog is prone to multiple input-validation vulnerabilities, including cross-site scripting, HTML-injection, and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, steal cookie-based authentication credentials, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
Insanely Simple Blog 0.5 and prior versions are vulnerable.
Insanely Simple Blog is prone to multiple input-validation vulnerabilities, including cross-site scripting, HTML-injection, and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, steal cookie-based authentication credentials, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
Insanely Simple Blog 0.5 and prior versions are vulnerable.
Exploit / POC
Insanely Simple Blog Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
Sample exploit code has been provided:
Attackers can use a browser to exploit these issues.
Sample exploit code has been provided:
Solution / Fix
Insanely Simple Blog Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Insanely Simple Blog Multiple Input Validation Vulnerabilities
References:
References:
- Insanely Simple Blog Homepage (Insanely Simple Blog)
- Insanely simple blog - Multiple vulnerabilities ([email protected])