65 matches found
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...
Design/Logic Flaw
article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service blog spam via a comment=new action...
CVE-2009-4909
admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...
CVE-2009-4904
article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service blog spam via a comment=new action...
CVE-2009-4903
CVE-2009-4903 describes a Cross-site Scripting (XSS) flaw in the web app oBlog . The vulnerability is in the file index.php and is exploitable via the search parameter , allowing remote attackers to inject arbitrary script/HTML. The NVD entry notes a non-authoritative provenance (“NOTE: the prove...
CVE-2009-4904
The CVE-2009-4904 issue affects the oBlog platform where article.php does not properly restrict comments, enabling remote attackers to trigger a denial of service (blog spam) through a comment=new action. The description does not specify affected versions or exact code root cause beyond insuffici...
CVE-2009-4903
Cross-site scripting XSS vulnerability in index.php in oBlog allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
CVE-2009-4909
The provided documents identify CVE-2009-4909 as a vulnerability in oBlog’s admin/index.php that allows remote attackers to perform brute-force password guessing via HTTP requests. This mode cites concrete details: affected component is the oBlog admin login, and the root cause is insufficient pr...
CVE-2009-4907
CVE-2009-4907 describes multiple CSRF vulnerabilities in oBlog that allow remote attackers to hijack administrator sessions and perform admin actions such as changing passwords, forcing logouts, altering post visibility, removing links, and changing blog name fields. The initial records do not sp...
CVE-2009-4907
Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...
CVE-2009-4908
CVE-2009-4908 describes multiple cross-site scripting (XSS) vulnerabilities in the oBlog platform. The issues enable remote attackers to inject arbitrary script/HTML via the following parameters: article.php (commentName, commentEmail, commentWeb, commentText); admin/write.php (article_id, title)...
oBlog Persistant XSS, CSRF, Admin Bruteforce
No description provided by source. ------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic...
oBlog Persistant XSS CSRF Admin Bruteforce
No description provided by source. ------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic...
oBlog - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin Brute Force
------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic Vulnerabilities: Persistant XSS, CSRF,...
oBlog Persistant XSS, CSRF, Admin Bruteforce
Exploit for unknown platform in category web applications ============================================ oBlog Persistant XSS, CSRF, Admin Bruteforce ============================================ -------------------------------------------------------------------------------------------------...
oBlog - Persistent Cross-Site Scripting Cross-Site Request Forgery Admin Brute Force
oBlog - Persistent Cross-Site Scripting Cross-Site Request Forgery Admin Brute Force ------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip...
oBlog Cross Site Scripting / Request Forgery
------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic Vulnerabilities: Persistant XSS, CSRF,...
Oblog多用户博客程序strMonth变量过滤不严导致SQL注入漏洞
文件In/ClassUserCommand.asp : 1. strMonth=Request"month" //第63行 2. 3. strDay=Request"day" 4. 5. …… 6. 7. Case "month" //第84行 8. 9. Dim LastDay 10. 11. GPFileName = GPFileName & "month&month=" & strMonth 12. 13. strDay=LeftstrMonth,4 & "-" & RightstrMonth,2 & "-01" 14. 15. mYear=LeftstrMonth,4 16. 1...
Oblog多用户博客程序attachment.asp页面越权漏洞
oBlog多用户博客程序是目前国内应用最广泛的博客程序。OBLOG程序已经广泛应用在国内数万家网站，覆盖国内上千万上网人群，并经过上千家知名网站的严格检测，被称为国内博客建站第一程序oBlog多用户博客程序”是目前国内应用最广泛的博客程序。 漏洞文件：attachment.asp 1. !-- include file= inc/incsyssite.asp -- 2. % 3. Dim Path,rs,FileID,ShowDownErr,uid,fileext 4. Dim SQL 5. Path = TrimRequest path 6. FileID = TrimRequest...
