PluggedOut Blog 1.51/1.60 - 'Blog_Exec.php' Cross-Site Scripting

Author: befcake beefy
type: webapps
platform: php
port: 
date_added: 2004-08-07 
date_updated: 2013-01-24 
verified: 1 
codes: OSVDB-8349 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/10885/info

PluggedOut Blog is reported prone to a cross-site scripting vulnerability.

This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/blog/blog_exec.php?action=remove_blog&blogid=<script>alert(document.cookie);</script>