Bit 5 Blog 8.1 AddComment.PHP HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Bit 5 Blog 8.1 AddComment.PHP HTML Injection Vulnerability. Failure to sanitize user input allows execution of HTML and script code in the context of the affected website, potentially leading to theft of authentication credentials and control of site rendering


                                                source: http://www.securityfocus.com/bid/16246/info

Bit 5 Blog is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

The following proof of concept is available:
&#60;a href=javascript:alert(123)&#62;clickme&#60;/a&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1