Zomplog Script Injection Vulnerability =>3.4 (all versions vulnerable)
zomplog is prone to xss injection attacks. It is possible for a malicious
zomplog user to inject hostile xss and script code into the commentary via form
fields. This code may be rendered in the browser of a web user who views the
commentary of zomplog.
zomplog does not adequately filter xss tags from various fields. This may
enable an attacker to inject arbitrary script code into pages that are
generated by the blog.
example:
put <script>alert('test')</script> in
http://localhost/zomplog/detail.php?id=1#comments
Zamplog home page: http://zomplog.zomp.nl/