<<< Date Index >>>     <<< Thread Index >>>

PluggedOut Blog SQL injection and XSS



PluggedOut Blog SQL INJECTION and XSS

PluggedOut Blog is an open source script you can run
on your web server to give you an online multi-user
journal or diary. 
It can be used equally well for any kind of calendar
application.Rather than give you a thousand things you
don't really want ...
PluggedOut Blog   : http://www.pluggedout.com/

Credit:
The information has been provided by Hamid Ebadi
(Hamid Network Security Team):admin@xxxxxxxx 
The original article can be found at:
http://hamid.ir/security/

Vulnerable Systems:
PluggedOut Blog  Version : Version: 1.9.9c
(2006-01-13) 

example :
The following URL can be used to trigger an SQL
injection vulnerability in the exec.php   : 
http://[PluggedOut
Blog]/exec.php?action=comment_add&entryid=[SQL
INJECTION]

and XSS 
http://[PluggedOut
Blog]/problem.php?id=1&data=<script>alert('Hamid
Network Security Team -->
http://hamid.ir');alert(document.cookie)</script>



Signature
 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com