Secunia

Some vulnerabilities have been discovered in Atom PhotoBlog, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "Your Name", "Your Homepage", and "Your Comment" form fields in atomPhotoBlog.php is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which will be executed in the administrator's browser session in context of an affected site when the administrator uses the "Approve Comments" functionality.

2) Input passed to the "tag" parameter in atomPhotoBlog.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

NOTE: Other parameters may also be affected.

The vulnerabilities are confirmed in version 1.0.9. Prior versions may also be affected.

Solution
Update to version 1.0.9.1.

Provided and/or discovered by
1) Discovered by the vendor.
2) ls

Changelog
Further details available in Customer Area

Original Advisory
2) http://www.secvsn.com/content/Advisories/sr-060607-atomphotoblog.html

Deep Links
Links available in Customer Area