Secunia

Aliaksandr Hartsuyeu has reported some vulnerabilities in Leif M. Wright's Blog, which can be exploited by malicious people to disclose potentially sensitive information, bypass certain security restrictions, conduct script insertion attacks, and potentially to compromise a vulnerable system.

1) The default installation does not properly restrict access to "txt" files using .htaccess. This can be exploited to retrieve the administrator's password from the configuration file.

2) The "blog.cgi" script does not validate the password submitted via the cookie when validating administrator access.

3) The administrative user is allowed to edit the full path to the "sendmail" program when modifying the blog configuration. This can be exploited to execute arbitrary shell commands and can potentially be exploited in conjunction with vulnerability #1 to compromise a vulnerable system.

4) Input passed in the HTTP_REFERER and HTTP_USER_AGENT HTTP request headers isn't sanitised before being saved. This can be exploited to execute arbitrary HTML and script code in the administrative user's browser session in context of an affected website when the "Log" page is viewed.

The vulnerabilities have been reported in version 3.5. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised and restrict access to the configuration files (e.g. with a .htaccess file).

Provided and/or discovered by
Aliaksandr Hartsuyeu

Changelog
Further details available in Customer Area

Original Advisory
http://evuln.com/vulns/82/summary.html

Deep Links
Links available in Customer Area