3nitro has reported two vulnerabilities in Ublog Reload, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose sensitive information.

1) Input passed to the "msg" parameter in "login.asp" isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The database file "mdb-database/ublogreload.mdb" is located inside the web root and therefore makes it possible to disclose the contents (e.g. the administrator's password).

The vulnerabilities have been reported in version 1.0.4 and prior.

Solution
Update to version 1.0.5.

Provided and/or discovered by
3nitro, PersianHacker.NET Security Team

Deep Links
Links available in Customer Area