Geeklog 'configuration.php' Multiple Cross Site Scripting Vulnerabilities
BID:45642
Info
Geeklog 'configuration.php' Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 45642 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 03 2011 12:00AM |
| Updated: | Jan 03 2011 12:00AM |
| Credit: | Aung Khant, YGN Ethical Hacker Group |
| Vulnerable: |
Geeklog Geeklog 1.5.2 sr2 Geeklog Geeklog 1.5.2 Geeklog Geeklog 1.5.1 Geeklog Geeklog 1.5 Geeklog Geeklog 1.4.1 Geeklog Geeklog 1.4 sr1 Geeklog Geeklog 1.3.11 sr4 Geeklog Geeklog 1.3.11 sr3 Geeklog Geeklog 1.3.11 sr1 Geeklog Geeklog 1.3.11 rc1 Geeklog Geeklog 1.3.11 Geeklog Geeklog 1.3.10 Geeklog Geeklog 1.3.9 sr3 Geeklog Geeklog 1.3.9 sr2 Geeklog Geeklog 1.3.9 sr1 Geeklog Geeklog 1.3.9 Geeklog Geeklog 1.3.8 rc2 Geeklog Geeklog 1.3.8 rc1 Geeklog Geeklog 1.3.8 -1sr2 Geeklog Geeklog 1.3.8 -1sr1 Geeklog Geeklog 1.3.8 -1 Geeklog Geeklog 1.3.8 Geeklog Geeklog 1.3.7 sr2 Geeklog Geeklog 1.3.7 sr1 Geeklog Geeklog 1.3.7 Geeklog Geeklog 1.3.5 sr2 Geeklog Geeklog 1.3.5 sr1 Geeklog Geeklog 1.3.5 Geeklog Geeklog 1.3 Geeklog Geeklog 1.6.0sr1 Geeklog Geeklog 1.4.0sr4 Geeklog Geeklog 1.4.0sr3 Geeklog Geeklog 1.4.0sr2 Geeklog Geeklog 1.3.9sr5 Geeklog Geeklog 1.3.11sr5 |
| Not Vulnerable: |
Geeklog Geeklog 1.7.1sr1 |
Discussion
Geeklog 'configuration.php' Multiple Cross Site Scripting Vulnerabilities
Geeklog is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Geeklog versions prior to 1.7.1sr1 are vulnerable.
Geeklog is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Geeklog versions prior to 1.7.1sr1 are vulnerable.
Exploit / POC
Geeklog 'configuration.php' Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
References
Geeklog 'configuration.php' Multiple Cross Site Scripting Vulnerabilities
References:
References:
- Geeklog / changeset (Geeklog)
- Product Homepage (Geeklog 1.7.1sr1)