bugtraq - bblog 0.7.2 cross site scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040326200845.23293.qmail@www.securityfocus.com>
Date: 26 Mar 2004 20:08:45 -0000
From: <penfold@...fnep.com>
To: bugtraq@...urityfocus.com
Subject: bblog 0.7.2 cross site scripting

Introduction:
Bblog, a blogging system scripted in PHP does not perform sufficient filtering when submitting a blog name. The severity of this flaw however, is low as the required privileges to access the administration panel for bblog is superuser.

The problem:
The flaw lies in bblog/index.php?b=options, where an *evil* attacker can quite possibly hijack a session. Submitting the blog name with the value of "< script >alert(document.cookie);< / script >" will insert this into the title of the blog, which in turn, speaks for itself.

Fix:
Filter the value of the blog name to disallow any html insertion.

Kind Regards,
penfold
http://www.dlofnep.com