typo-sqlxss.txt

`======================================================================  
Typo <= 5.1.3 Multiple Vulnerabilities  
======================================================================  
  
Author: L4teral <l4teral [at] gmail com>  
Impact: Cross Site Scripting  
SQL Injection  
Insecure password hash salt  
Status: patch not available  
  
  
------------------------------  
Affected software description:  
------------------------------  
  
Application: Typo  
Version: <= 5.1.3  
Vendor: http://typosphere.org  
  
Description:  
Typo is a blogging engine developped with the Ruby on Rails framework.  
  
  
--------------  
Vulnerability:  
--------------  
  
1. The feedback system is vulnerable to cross site scripting.  
Script code can be embedded into the "Name" and "Website" fields  
when posting a new comment. If the comments are viewed in the admin  
panel, the code gets executed in the context of the admin user.  
The code embedded in the website paramter also gets executed when  
viewing the blog post as normal user.  
  
2. The "Manage pages" part of the administration panel is prone to  
SQL injection. The parameter "published_at" is not properly  
sanitized due to an erroneous regular expression.  
"Blog publisher" rights are needed to exploit this issue.  
  
3. The application uses a salt when storing the password hashes, but  
the salt is set to a hardcoded value making the salt less efficient  
as equal passwords result in the same hash value.  
  
  
---------  
Timeline:  
---------  
  
2008-09-29 - vendor informed  
2008-10-02 - vendor informed  
2008-10-30 - no response from vendor, public disclosure  
`