Geeklog 1.3.7 - 'Homepage User' HTML Injection

Author: snooq
type: webapps
platform: php
port: 
date_added: 2003-01-14 
date_updated: 2012-10-22 
verified: 1 
codes: CVE-2003-1347;OSVDB-59445 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/6604/info

Geeklog is prone to HTML injection attacks.

The user account 'Homepage' field is not sufficiently sanitized of HTML and script code. As a result, a malicious user may inject malicious HTML and script code into this field. When the malicious user's account information is displayed to other web users, the attacker-supplied code will be interpreted in their web client in the security context of the site hosting the vulnerable software.

http://url" onmouseover="alert(document.cookie)