Geeklog 1.3.7 - 'Homepage User' HTML Injection

Author: snooq
type: webapps
platform: php
port: 0
date_added: 2003-01-14
date_updated: 2012-10-22
verified: 1
codes: CVE-2003-1347;OSVDB-59445
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/6604/info

Geeklog is prone to HTML injection attacks.

The user account 'Homepage' field is not sufficiently sanitized of HTML and script code. As a result, a malicious user may inject malicious HTML and script code into this field. When the malicious user's account information is displayed to other web users, the attacker-supplied code will be interpreted in their web client in the security context of the site hosting the vulnerable software.

http://url" onmouseover="alert(document.cookie)