Exploit Database - Logo

BlogPHP 2.0 - 'index.php' Multiple Parameter Cross-Site Scripting

EDB-ID: 31774 Author: David Sopas Ferreira Published: 2008-05-10
CVE: CVE-2008-6631 Type: Webapps Platform: PHP
Aliases: N/A Advisory/Source: Link Tags: N/A
E-DB Verified: Verified Exploit: Download Exploit Code Download / View Raw Vulnerable App: Download Vulnerable Application
« Previous Exploit Next Exploit » 
source: http://www.securityfocus.com/bid/29133/info

BlogPHP is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue, an HTML-injection issue, and a cookie-manipulation issue.

Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, and gain access as an arbitrary user.

BlogPHP 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?act=sendmessage&user=admin[XSS]

Related Exploits

Trying to match CVEs (1): CVE-2008-6631
Trying to match OSVDBs (1): 45038
Trying to match setup file: ff3839cd5c3f5ce099932fd08cbd326a
Other Possible E-DB Search Terms: BlogPHP 2.0,  BlogPHP
Date D V Title Author
2006-01-16Download Exploit Code Verified BlogPHP 1.0 - 'index.php' SQL InjectionAliaksandr ...
2008-02-02Download Exploit Code Verified BlogPHP 2 - 'id' Parameter Cross-Site Scripting / SQL InjectionKhashayar F...
2011-08-09Download Exploit Code Waiting verification BlogPHP 2.0 - Persistent Cross-Site ScriptingPaulzz
2008-06-23Download Exploit Code Verified BlogPHP 2.0 - Privilege Escalation (via SQL Injection)Cod3rZ
2006-01-20Download Exploit Code Verified BlogPHP 1.2 - Multiple SQL Injectionsimei
Menu