Bugtraq mailing list archives
bblog 0.7.2 cross site scripting
From: <penfold () dlofnep com>
Date: 26 Mar 2004 20:08:45 -0000
Introduction: Bblog, a blogging system scripted in PHP does not perform sufficient filtering when submitting a blog name. The severity of this flaw however, is low as the required privileges to access the administration panel for bblog is superuser. The problem: The flaw lies in bblog/index.php?b=options, where an *evil* attacker can quite possibly hijack a session. Submitting the blog name with the value of "< script >alert(document.cookie);< / script >" will insert this into the title of the blog, which in turn, speaks for itself. Fix: Filter the value of the blog name to disallow any html insertion. Kind Regards, penfold http://www.dlofnep.com
Current thread:
- bblog 0.7.2 cross site scripting penfold (Mar 26)