b2evolution 4.0.3 - Persistent Cross-Site Scripting

Author: AutoSec Tools
type: webapps
platform: php
port: 
date_added: 2011-03-16 
date_updated: 2011-03-16 
verified: 0 
codes: OSVDB-71192 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comb2evolution-4.0.3-stable-2010-12-24.zip

Source: http://packetstormsecurity.org/files/view/99362/b2evolution403-xss.txt

------------------------------------------------------------------------
Software................b2evolution 4.0.3
Vulnerability...........Persistent Cross-site Scripting
Threat Level............Moderate (2/5)
Download................http://b2evolution.net/
Vendor Contact Date.....3/15/2011
Disclosure Date.........3/15/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A persistent cross-site scripting vulnerability in b2evolution 4.0.3
can be exploited to execute arbitrary JavaScript.


--Exploit--

Data submitted to the "Comment text" input of the blog comment form is
not properly santized. As a result, javascript can be executed
throughout the application (admin dashboard, admin comment full text
view, possibly other pages).


--PoC--

<?<a><script>alert(0)</script>