Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	6601
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2003 12:00AM
Updated:	Jan 14 2003 12:00AM
Credit:	Discovery of this issue is credited to snooq <[email protected]> and Dirk Haun of The Geeklog Team.
Vulnerable:	Geeklog Geeklog 1.3.7
Not Vulnerable:	Geeklog Geeklog 1.3.7 sr1

Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

The Geeklog 'profiles.php' script is prone to multiple cross-site scripting vulnerabilities.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Geeklog, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client.

Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

There is no exploit required. The following examples were submitted:

http://www.example.com/profiles.php?uid=<script>alert(document.cookie)</script>

http://www.example.com//profiles.php?what=contact&author=ich&authoremail=bla%40bla.com&subject=hello&message=text&uid=<script>alert(document.cookie)</script>

Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

Solution:
This issue was addressed in Geeklog 1.3.7 sr1.


Geeklog Geeklog 1.3.7

• Geeklog Geeklog 1.3.7 sr1
  http://www.geeklog.net/filemgmt/visit.php?lid=101

Geeklog Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

References:

• Multiple XSS in Geeklog 1.3.7 (snooq )