PluggedOut Blog 1.51/1.60 - 'Blog_Exec.php' Cross-Site Scripting

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054553 漏洞类型
发布时间 2004-08-07 更新时间 2004-08-07
CVE编号 N/A CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24357
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10885/info

PluggedOut Blog is reported prone to a cross-site scripting vulnerability.

This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software. 

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/blog/blog_exec.php?action=remove_blog&blogid=<script>alert(document.cookie);</script>