BlogMan 'Title' HTML Injection Vulnerability

Bugtraq ID:	34359
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 03 2009 12:00AM
Updated:	Apr 03 2009 11:56PM
Credit:	The vendor.
Vulnerable:	BlogMan BlogMan 0.6.1 BlogMan BlogMan 0.6
Not Vulnerable:	BlogMan BlogMan 0.7

BlogMan 'Title' HTML Injection Vulnerability

BlogMan is prone to a HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or script code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Versions prior to BlogMan 0.7 are vulnerable.

BlogMan 'Title' HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

BlogMan 'Title' HTML Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


BlogMan BlogMan 0.6

• BlogMan blogman-v0.7.tar.bz2
  http://sourceforge.net/project/downloading.php?group_id=251578&use_mir ror=heanet&filename=blogman-v0.7.tar.bz2&a=58147714

BlogMan BlogMan 0.6.1

• BlogMan blogman-v0.7.tar.bz2
  http://sourceforge.net/project/downloading.php?group_id=251578&use_mir ror=heanet&filename=blogman-v0.7.tar.bz2&a=58147714

BlogMan 'Title' HTML Injection Vulnerability

References:

• BLOGMAN CHANGELOG (BlogMan)
  
• BlogMan Home Page (BlogMan)