[34269] in bugtraq
bblog 0.7.2 cross site scripting
daemon@ATHENA.MIT.EDU (penfold@dlofnep.com)
Fri Mar 26 19:49:44 2004
Date: 26 Mar 2004 20:08:45 -0000
Message-ID: <20040326200845.23293.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: <penfold@dlofnep.com>
To: bugtraq@securityfocus.com
Introduction:
Bblog, a blogging system scripted in PHP does not perform sufficient filtering when submitting a blog name. The severity of this flaw however, is low as the required privileges to access the administration panel for bblog is superuser.
The problem:
The flaw lies in bblog/index.php?b=options, where an *evil* attacker can quite possibly hijack a session. Submitting the blog name with the value of "< script >alert(document.cookie);< / script >" will insert this into the title of the blog, which in turn, speaks for itself.
Fix:
Filter the value of the blog name to disallow any html insertion.
Kind Regards,
penfold
http://www.dlofnep.com
