Exploit PluggedOut Blog 1.51/1.60 - 'Blog_Exec.php' Cross-Site Scripting

[Exploiter]

EDB-ID

24357

Проверка EDB

1. Пройдено

Автор

BEFCAKE BEEFY

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2004-08-07

PluggedOut Blog 1.51/1.60 - 'Blog_Exec.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/10885/info

PluggedOut Blog is reported prone to a cross-site scripting vulnerability.

This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software. 

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/blog/blog_exec.php?action=remove_blog&blogid=<script>alert(document.cookie);</script>