Sign in
CVE-2009-4908
CVE-2009-4908
Description
Multiple cross-site scripting (XSS) vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the (1) commentName, (2) commentEmail, (3) commentWeb, or (4) commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via the (5) article_id or (6) title parameter to admin/write.php, the (7) category_id or (8) category_name parameter to admin/groups.php, the (9) blogroll_id or (10) title parameter to admin/blogroll.php, or the (11) blog_name or (12) tag_line parameter to admin/settings.php.
Impact
CVSS v2 : 4.3 MEDIUM
Type
CWE-79
Attack Vector
CVSSv2 Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N
Quick links
CVE
,
NVD
,
CERT
,
Metasploit
,
Exploit-db
,
Fulldisc
,
Bugtraq
,
Microsoft
,
Red Hat
,
Debian
, GitHub
code
/
issues
,
Google
References
http://osvdb.org/60906
http://packetstormsecurity.org/0912-exploits/oblog-xssxsrf.txt
http://secunia.com/advisories/37661
https://exchange.xforce.ibmcloud.com/vulnerabilities/54713
FAQ
Terms of service
Privacy policy