Dotho has reported a vulnerability in Cloisterblog, which can be exploited by malicious people to conduct Cross Site Scripting and directory traversal attacks.

Certain input isn't properly verified before it is returned to the user or used to include files. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of an affected site by tricking the user into visiting a malicious website or follow a specially crafted link. It is also possible to disclose the content of arbitrary files.

The user authentication only verifies the password and not the username. This makes it easier to guess the credentials.

The vulnerabilities have been reported in version 1.2.2.

Solution
Edit the source code to ensure that input is properly verified. Use strong passwords.
Further details available in Customer Area

Provided and/or discovered by
Dotho

Deep Links
Links available in Customer Area