Secunia Advisory: SA10496 Print Advisory
Release Date: 2003-12-28

Critical: Moderately critical
Impact: Cross Site Scripting
Manipulation of data
Exposure of system information
Exposure of sensitive information
Where: From remote

Software: PsychoBlogger


Description:
Calum Power has reported multiple vulnerabilities in PsychoBlogger, which can be exploited by malicious people to conduct Cross-Site Scripting attacks and SQL injection attacks.

The vulnerabilities are caused due to missing validation of input supplied to the:
* "desc" variable in "imageview.php".
* "errormessage" parameter in "entryadmin.php", "authoredit.php", "blockedit.php", "configadmin.php", and "quoteedit.php".
* "shoutlimit" variable in "shouts.php".
* "blogid" variable in "comments.php".
* "category.php".

Successful exploitation may allow execution of arbitrary HTML or script code in a user's browser session or allow manipulation of SQL queries.

Solution:
Edit the source code to ensure that user input is properly sanitised before being used.

Provided and/or discovered by:
Calum Power

Original Advisory:
Multiple vulnerabilities in Psychoblogger CMS package
http://www.fribble.net/advisories/psychoblogger_19-12-03.txt

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News