Geeklog Comment.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	6603
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 14 2003 12:00AM
Updated:	Jan 14 2003 12:00AM
Credit:	Discovery of this issue is credited to Dirk Haun of The Geeklog Team.
Vulnerable:	Geeklog Geeklog 1.3.7
Not Vulnerable:	Geeklog Geeklog 1.3.7 sr1

Geeklog Comment.PHP Cross-Site Scripting Vulnerability

Geeklog is prone to a cross-site scripting vulnerability in the 'comment.php' script.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Geeklog, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client.

Geeklog Comment.PHP Cross-Site Scripting Vulnerability

There is no exploit required. The following example was submitted:

http://www.example.com//comment.php?mode=Delete&sid=1&cid=<script>alert(document.cookie)</script>

Geeklog Comment.PHP Cross-Site Scripting Vulnerability

Solution:
This issue was addressed in Geeklog 1.3.7 sr1.


Geeklog Geeklog 1.3.7

• Geeklog Geeklog 1.3.7 sr1
  http://www.geeklog.net/filemgmt/visit.php?lid=101

Geeklog Comment.PHP Cross-Site Scripting Vulnerability

References:

• Multiple XSS in Geeklog 1.3.7 (snooq )