lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <BAY10-DAV334136203078098647596FD9E60@phx.gbl> Date: Tue Jul 5 17:47:31 2005 From: se_cur_ity at hotmail.com (Morning Wood) Subject: Quickblogger ------------------------------------------------------------ - EXPL-A-2005-011 exploitlabs.com Advisory 040 - ------------------------------------------------------------ - QuickBlogger - AFFECTED PRODUCTS ================= QuickBlogger 1.4 ( and earlier ) http://www.jlwebworks.net/ OVERVIEW ======== QuickBlogger is a freeware flatfile php blog script written to simplify updating your blog/website. DETAILS ======= 1. XSS Quickblog comments section does not properly filter malicious script content. XSS my be inserted in the author and comment body sections. The malicious script is the rendered upon visitation and executed in the context of the users brower. POC === 1. ------ insert script into the "your name" and or the "comment" section. SOLUTION: ========= vendor contact: webmaster@...ebworks.net June 11, 2005 webmaster@...ebworks.net June 21, 2005 no response recieved Credits ======= This vulnerability was discovered and researched by Donnie Werner of exploitlabs Donnie Werner mail: wood at exploitlabs.com mail: morning_wood at zone-h.org -- web: http://exploitlabs.com web: http://zone-h.org http://exploitlabs.com/files/advisories/EXPL-A-2005-011-quickblogger.txt
Powered by blists - more mailing lists