bugtraq - FC2 BLOG Cross-Site Scripting Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 9 Oct 2008 09:35:29 +0800
From: xsp <xisigr@...il.com>
To: bugtraq@...urityfocus.com
Subject: FC2 BLOG Cross-Site Scripting Vulnerabilities

Subject: FC2 BLOG Cross-Site Scripting Vulnerabilities
Application: FC2 BLOG
Vendor:BLOG.FC2.COM
Corporation: FC2, Inc.
DATE : 9 Oct 2008
Description: FC2 BLOG Cross-Site Scripting Vulnerabilities

Vulnerability:
==============
They do not properly sanitize the potentially malicious input content
to be rendered and, as a result, an attacker might provide malicious
HTML content as part of A New Entry.

Exploit:
==============
Write A New Entry in FC2 blog:
<input type="image" src="x" onerror="javascript:alert(/XSP/)" />

==============
xisigr[topsec]
xisigr@...il.com