lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <BAY10-DAV334136203078098647596FD9E60@phx.gbl>
Date: Tue Jul  5 17:47:31 2005
From: se_cur_ity at hotmail.com (Morning Wood)
Subject: Quickblogger

------------------------------------------------------------
    - EXPL-A-2005-011 exploitlabs.com Advisory 040 -
------------------------------------------------------------
                                   - QuickBlogger -






AFFECTED PRODUCTS
=================
QuickBlogger 1.4 ( and earlier )
http://www.jlwebworks.net/



OVERVIEW
========
QuickBlogger is a freeware flatfile php blog script
 written to simplify updating your blog/website.




DETAILS
=======
1. XSS

Quickblog comments section does not properly filter
malicious script content. XSS my be inserted in the
author and comment body sections. The malicious script
is the rendered upon visitation and executed in the
context of the users brower.




POC
===

1.
------

insert script into the "your name" and or
the "comment" section.




SOLUTION:
=========
vendor contact:
webmaster@...ebworks.net June 11, 2005
webmaster@...ebworks.net June 21, 2005

no response recieved



Credits
=======
This vulnerability was discovered and researched by 
Donnie Werner of exploitlabs

Donnie Werner

mail:   wood at exploitlabs.com
mail:   morning_wood at zone-h.org
-- 
web: http://exploitlabs.com
web: http://zone-h.org

http://exploitlabs.com/files/advisories/EXPL-A-2005-011-quickblogger.txt

Powered by blists - more mailing lists